smithj@jacobs.CS.ORST.EDU (Jeremy Smith) (03/14/90)
> From: dan@Apple.COM (Dan Allen) > > For example, I was using the debugger to dump memory to the serial port > at 9600 baud. I had no idea what I was doing, but all I did was run > MacTerminal at 9600 baud and voila, I had the ROM image on my Mac as a > text file... I dumped out memory to the PC and then translated the code from HEX to ASCII in order to locate strings. There was nothing unusual (like poems, peoples names, and so on) but it often acts as a point of departure for further study to know locations of strings. Hook the 48 to the PC and establish contact. Enter the debugger (ON-D simultaneously, back arrow). Press . (decimal point) for a dump of the eight bytes in the display, or spc for a whole 32k starting at the current address. Here is a string rich area as dumped and translated: 719B0:403505440240449 SPD DI 72000:8E920C7200C2A20 ) ' ,* 719C0:3505409425F4D44 SP IROM 72010:000001000B20009 I 719D0:942514D440B4244 IRAM KBD 72020:E63757666696369 nsuffici 719E0:1340B424442330B 1 KBD2 K 72030:56E64702D456D6F ent Memo 719F0:2444E0543544022 BD ESD 2 72040:2797B2000449627 ry+ @ &W 71A00:130365020223130 10V 210 72050:63647F627970225 6F & "U 71A10:653054354420F4B V ESD OK 72060:63657273796F6E6 6V'7 71A20:60F4B4D24383024 OK-48 72070:200055E64656669 Undefi 71A30:641494C44055F5C FAIL U_L 72080:E6564602C4F6361 ned Loca 71A40:244055142545A05 B UART U 72090:C602E416D656B20 l Name+ 71A50:F5C4240285D4944 _LB XMIT 720A0:055E646566696E6 P FVf V 71A60:40904596D656029 Time I 720B0:6460285C4942402 F $ 71A70:E69647603547162 nit Star 720C0:416D656D1000D45 V Me 71A80:47A360641696C60 t: Fail 720D0:D6F627970234C65 mory Cle 71A90:A34005F42545402 : PORT R 720E0:16279100005F677 ar vW 71AA0:14D413402514D42 AM1 RAM2 720F0:62702C4F6374751 & 6GW 71AB0:409425C42440942 IRLB IR 72100:00751627E696E67 Warning 71AC0:94F4403554E4444 IO SEND 72110:A37200094E66716 :' f 71AD0:25543465E065562 RECV Ver 72120:696460234162746 F 2 &G 71AE0:3796F6E60284054 sion HP4 72130:244164716F1000F B F O 71AF0:83D2141134F6079 8-A Copy 72140:26A65636470294E bject In 71B00:279676864702840 right HP 72150:025537569200005 Use) 71B10:021393839376713 1989g C 72160:6274702E4F64702 &G F Note that each byte has its nibbles reversed. > From: billw@hpcvra.CV.HP.COM (William C Wickes) > > To make life more interesting, the fields are written backwards (this > is how the CPU reads memory), so e.g. the prolog is written E1B20. Here are some other addresses with strings occurring at or after that address (tables indicate what could be look-up tables - just my notes as I was browsing): 045d0: LowBat 18f70: week(s) day(s) hour(s) minute(s) second(s) ticks 1ff30: Intercept 1ff50: Slope 218d0: SYSRAM 253a0: TO DIR ELSE END UNTIL REPEAT NEXT STEP THEN 29710: Invalid Expression 2d3b0: PACKET ERRMSG LNAME OPOS KMODE 2ea60: IOPAR 31f80: PRTPAR 34dc0: symbx 39250: - 39550: tables 3b750: DBUG 3c070: HIST 3c370: RESET 3c7d0: TIME EXEC SET DAY MIN NONE DATE NEW EDIT LENG VOL SPEED FORCE POWR TEMP ANGL VISC then lots of unit abbreviations... 3f410: PORT 3fad0: SKEY 48770: SOLVR 487d0: PLOTR 48a80: STK 48ad0: undefined 48d50: Alrmdat execs root 56990: sumvar 60810: regm ctsm mlgm prdm 60bf0: pattern 63xxx: more tables... 65260: UNKNOWN 65330: GROB 69aa0: Radix 69ac0: Exp 69af0: buffm 69b20: ManOpm 69b50: Modem <--------hmmmmmmmmmmmmmm? 69ce0: unbound 6fxxx: block of zeros at end of 6xxxx block 719b0: SPD DISP IROM IRAM KBDI KBD2 KBD ESD 210V 210V ESD OK OK-48 FAIL U_LB UART U_LB XMIT Time Init Starti Fail: Port RAM1 RAM2 IRLB IRIO SEND RECV Version HP48-A Copyright HP 1989 Insufficient memory Undefined location Memory Clear 73xxx: lots of error messages 7373e: - 7a741: unit names 73746: - 7b757: fcn names 79xxx: - 7axxx: interesting patterns 7f9b0: homedir 7fff0: HP48-A 8xxxx: - fxxxx: I haven't looked at pages 8 through f apart from e: exxxx: this whole 32k page is a repeat of page 6xxxx. I threw together the following C code to generate the translated 48 core dump (no apologies for assembly/Pascal in C :-). Note that characters below ASCII 32 (space) or above ASCII 127 (DEL) were translated to spaces. A good modification would be to send out streams of text with just addresses embedded every 128 bytes, for easier reading and searching for text strings. Source for program: asci2hex /* usage: asci2hex < 48_core[input file] > 48_core.asc[output file] #include <stdio.h> #include <stdlib.h> main() { int c, i, j, f, g, l; char a[23], b[9]; f=0; g=0; while ((c=getchar()) != EOF) { a[f++]=c; if (c==58) { for (i=0; i<8; i++) { c=getchar(); a[f++]=c; if (c<60) c=c-48; else c=c-55; l=c; c=getchar(); a[f++]=c; if (c<60) c=c-48; else c=c-55; c=c*16+l; if ((c<32)|(c>126)) c=32; b[g++]=c; a[22]='\0'; b[8]='\0'; } printf("%s %s", a, b); f=0; g=0; } } }
alonzo@microsoft.UUCP (Alonzo GARIEPY) (03/16/90)
In article <16848@orstcs.CS.ORST.EDU> smithj@jacobs.CS.ORST.EDU.UUCP (Jeremy Smith) writes: > > 719B0:403505440240449 SPD DI 72000:8E920C7200C2A20 ) ' ,* > ... > 7fff0: HP48-A I noticed that you only looked for strings at even addresses. Because the HP 48 (and HP 28) are nibble based, strings can also start at odd addresses. My memory scanner for the 28 prints out each segment of memory twice, the second offset by a nibble, for just this reason. Happy hunting, Alonzo Gariepy alonzo@microsoft