fabi/Syplheed-Reborn
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

re: recover the ISL interpreter's command table — 57 opcodes, committed

Browse Source 
sub_822FE040 fills 1023 eight-byte slots at table+32 with a default and then
overwrites individual ones; slot = (N - 32) / 8 from each std r9, N(r31).
Symbolically executing it yields 57 populated slots, matching the count the
corpus recorded, now with the full opcode -> handler map committed as
docs/re/data/isl-command-table.txt and regenerable from
tools/re-capture/isl_cmdtab.py.

Nine opcodes point at 0x82391BA8, which is `li r3,1 ; blr` -- accept and
discard. 768, 769, 774, 775, 776, 791, 792, 793 and 805 are dead in this
build, which is why the built-ins posting them do nothing.

Opcodes 800-802's entries are thunks 8 bytes apart into 60-instruction
handlers that differ in exactly two words: a descriptor offset and a unit
message id.

  800  builtin 26        0xED0802DE
  801  builtin 28        0xED0803DE
  802  builtin 29, 101   0xED0804DE

That fixes the id format as 0xED08 nn DE, and the ids known from other work
fit it: opcode 514 -> 00DE, 803 -> 07DE, 999 -> 0FDE.

Stopped one link short of the semantics, and saying so: the pump's arm for
0xED0802DE does not apply an effect. It walks the unit's child list at
[unit+320]/[unit+324] and REBROADCASTS to each child as 0xED0902DE. So 0xED08
is the to-unit family and 0xED09 the to-child one, and the terminal effect is
further on. 26/28/29 remain unnamed.

The command table is the reusable part -- it answers "what does this opcode
reach" for every future built-in question, not just this family.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PMRJjbxLqZtsb5Vb7KunPE
This commit is contained in:
Sylpheed RE agent
2026-08-26 01:44:49 +00:00
parent 8d1c9d1c77
commit 1707b6b74a
3 changed files with 154 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
docs/re/structures/isl-builtins.md
View File

@@ -140,6 +140,39 @@ and spread checks but its maximum *exceeds* the table — flag indices run 0..31
against symbol tables as small as 40 — so it is excluded, and the disassembler
now declines to resolve it rather than printing an invented name.
### ✅ The interpreter's command table, recovered
`sub_822FE040` fills 1023 eight-byte slots at `table+32` with a default and then
overwrites individual ones; slot = `(N - 32) / 8` from each `std r9, N(r31)`.
Symbolically executing it yields **57 populated slots** — the full opcode →
handler map, committed as [`data/isl-command-table.txt`](../data/isl-command-table.txt)
and regenerable with `tools/re-capture/isl_cmdtab.py`.
Nine opcodes point at `0x82391BA8`, which is `li r3,1 ; blr` — accept-and-discard.
**768, 769, 774, 775, 776, 791, 792, 793 and 805 are dead in this build**, which
is why the built-ins that post them do nothing.
### ✅ Opcodes 800–802 send unit messages `0xED08 nn DE`
Their table entries are thunks 8 bytes apart into handlers `0x823008C8`,
`0x823009B8`, `0x82300AA8` — each 60 instructions, and **differing in exactly two
words**: a descriptor offset and the message id.
| opcode | built-in | unit message |
|---|---|---|
| 800 | 26 | **`0xED0802DE`** |
| 801 | **28** | **`0xED0803DE`** |
| 802 | **29**, 101 | **`0xED0804DE`** |
That fixes the id format as `0xED08 nn DE`, and the ids already known from other
work fit it: opcode 514 → `00DE`, 803 → `07DE`, 999 → `0FDE`.
🟡 The pump's arm for `0xED0802DE` does **not** apply an effect — it walks the
unit's child list at `[unit+320]`/`[unit+324]` and **rebroadcasts** to each child
as `0xED0902DE`. So `0xED08…` is the to-unit family and `0xED09…` the to-child
one, and the terminal effect is one link further on. ❌ Not followed; 26/28/29
remain unnamed.
### 🟡 Built-ins 26 / 28 / 29 are one family — and `damage_unit` looks mis-named
Method-diffing put the structure beyond doubt but did not reach the semantics.