P1-C: U4 resolved — WM dispatch = runtime registration list (parser 0xe00412e6, arrays in r5); scan_registrations.py; 130 ABI-named WM handlers + 29 WA; Ghidra labels applied (400 fns); findings F9
This commit is contained in:
parent
42349632fe
commit
6eb5a53182
6 changed files with 1004 additions and 13 deletions
29
dataset/wa_handlers_named.txt
Normal file
29
dataset/wa_handlers_named.txt
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
0x10201308 id=0x01 fn=0x10201bd0 MCU_EXT_CMD_EFUSE_ACCESS
|
||||
0x1020130c id=0x02 fn=0x10201b90 MCU_EXT_CMD_DEV_INFO_UPDATE
|
||||
0x10201310 id=0x03 fn=0x10201ba4 (MTK-internal id)
|
||||
0x10201314 id=0x04 fn=0x10201b78 MCU_EXT_CMD_RF_TEST
|
||||
0x10201320 id=0x07 fn=0x10201934 MCU_EXT_CMD_PM_STATE_CTRL
|
||||
0x10201324 id=0x08 fn=0x10201910 MCU_EXT_CMD_CHANNEL_SWITCH
|
||||
0x10201330 id=0x0b fn=0x1020164c (MTK-internal id)
|
||||
0x1020133c id=0x0e fn=0x10201614 (MTK-internal id)
|
||||
0x10201340 id=0x0f fn=0x102015f0 (MTK-internal id)
|
||||
0x10201344 id=0x10 fn=0x102015c4 (MTK-internal id)
|
||||
0x10201348 id=0x11 fn=0x102015a0 MCU_EXT_CMD_SET_TX_POWER_CTRL
|
||||
0x1020134c id=0x12 fn=0x102018fc (MTK-internal id)
|
||||
0x10201350 id=0x13 fn=0x102016fc MCU_EXT_CMD_FW_LOG_2_HOST
|
||||
0x10201354 id=0x14 fn=0x102016bc (MTK-internal id)
|
||||
0x10201358 id=0x15 fn=0x10201688 (MTK-internal id)
|
||||
0x1020135c id=0x16 fn=0x1020158c (MTK-internal id)
|
||||
0x10201360 id=0x17 fn=0x10201580 (MTK-internal id)
|
||||
0x10201364 id=0x18 fn=0x1020155c (MTK-internal id)
|
||||
0x10201368 id=0x19 fn=0x10201530 (MTK-internal id)
|
||||
0x1020138c id=0x22 fn=0x102014fc (MTK-internal id)
|
||||
0x10201390 id=0x23 fn=0x1020143c MCU_EXT_CMD_THERMAL_PROT
|
||||
0x102013a4 id=0x28 fn=0x10201408 (MTK-internal id)
|
||||
0x102013a8 id=0x29 fn=0x10201944 (MTK-internal id)
|
||||
0x102013ac id=0x2a fn=0x102014e4 (MTK-internal id)
|
||||
0x102013b0 id=0x2b fn=0x10201520 (MTK-internal id)
|
||||
0x102013b4 id=0x2c fn=0x10201634 MCU_EXT_CMD_THERMAL_CTRL
|
||||
0x102013c8 id=0x31 fn=0x10201668 (MTK-internal id)
|
||||
0x102013cc id=0x32 fn=0x10201674 MCU_EXT_CMD_WTBL_UPDATE
|
||||
0x10201404 id=0x40 fn=0x10201950 (MTK-internal id)
|
||||
422
dataset/wm_handlers_named.txt
Normal file
422
dataset/wm_handlers_named.txt
Normal file
|
|
@ -0,0 +1,422 @@
|
|||
# 9-entry {id,fn} array @ 0x02231ba8 (r5_t0_a02229800.bin)
|
||||
0x02231ba8 id=0x00 fn=0xf009707c (MTK-internal id)
|
||||
0x02231bb0 id=0x09 fn=0xf00963a6 (MTK-internal id)
|
||||
0x02231bb8 id=0x0a fn=0xf0096430 (MTK-internal id)
|
||||
0x02231bc0 id=0x0e fn=0xf0096846 (MTK-internal id)
|
||||
0x02231bc8 id=0x0d fn=0xe0040280 (MTK-internal id)
|
||||
0x02231bd0 id=0x0f fn=0xf0096b72 (MTK-internal id)
|
||||
0x02231bd8 id=0x01 fn=0xe00795c8 MCU_EXT_CMD_EFUSE_ACCESS
|
||||
0x02231be0 id=0x03 fn=0xe00799a8 (MTK-internal id)
|
||||
0x02231be8 id=0x04 fn=0xe0067480 MCU_EXT_CMD_RF_TEST
|
||||
# 29-entry {id,fn} array @ 0x02231bf8 (r5_t0_a02229800.bin)
|
||||
0x02231bf8 id=0x06 fn=0xf00969ca (MTK-internal id)
|
||||
0x02231c00 id=0x0b fn=0xe004649e (MTK-internal id)
|
||||
0x02231c08 id=0x0c fn=0xf0096150 (MTK-internal id)
|
||||
0x02231c10 id=0x10 fn=0xf009606e (MTK-internal id)
|
||||
0x02231c18 id=0x11 fn=0xf00961a4 MCU_EXT_CMD_SET_TX_POWER_CTRL
|
||||
0x02231c20 id=0x12 fn=0xe0098294 (MTK-internal id)
|
||||
0x02231c28 id=0x14 fn=0xe00660b0 (MTK-internal id)
|
||||
0x02231c30 id=0x24 fn=0xf00961f8 (MTK-internal id)
|
||||
0x02231c38 id=0x18 fn=0xf0096000 (MTK-internal id)
|
||||
0x02231c40 id=0x00 fn=0xe003fae4 (MTK-internal id)
|
||||
0x02231c48 id=0x01 fn=0xe003fbe8 MCU_EXT_CMD_EFUSE_ACCESS
|
||||
0x02231c50 id=0x02 fn=0xe003fc4c MCU_EXT_CMD_DEV_INFO_UPDATE
|
||||
0x02231c58 id=0x03 fn=0xe003fcb0 (MTK-internal id)
|
||||
0x02231c60 id=0x04 fn=0xe003fd14 MCU_EXT_CMD_RF_TEST
|
||||
0x02231c68 id=0x05 fn=0xe003fd78 MCU_EXT_CMD_ID_RADIO_ON_OFF_CTRL
|
||||
0x02231c70 id=0x06 fn=0xe003fda4 (MTK-internal id)
|
||||
0x02231c78 id=0x07 fn=0xe003fdda MCU_EXT_CMD_PM_STATE_CTRL
|
||||
0x02231c80 id=0x08 fn=0xe003ff5c MCU_EXT_CMD_CHANNEL_SWITCH
|
||||
0x02231c88 id=0x09 fn=0xe0040000 (MTK-internal id)
|
||||
0x02231c90 id=0x0a fn=0xe0040056 (MTK-internal id)
|
||||
0x02231c98 id=0x0c fn=0xe003face (MTK-internal id)
|
||||
0x02231ca0 id=0x0d fn=0xe0040082 (MTK-internal id)
|
||||
0x02231ca8 id=0x0e fn=0xe003fae0 (MTK-internal id)
|
||||
0x02231cb0 id=0x0f fn=0xe00400ae (MTK-internal id)
|
||||
0x02231cb8 id=0x10 fn=0xe00401b8 (MTK-internal id)
|
||||
0x02231cc0 id=0x11 fn=0xe003fe5e MCU_EXT_CMD_SET_TX_POWER_CTRL
|
||||
0x02231cc8 id=0x13 fn=0xe00401e4 MCU_EXT_CMD_FW_LOG_2_HOST
|
||||
0x02231cd0 id=0x12 fn=0xe00401f6 (MTK-internal id)
|
||||
0x02231cd8 id=0x15 fn=0xe0040254 (MTK-internal id)
|
||||
# 38-entry {id,fn} array @ 0x02231ea8 (r5_t0_a02229800.bin)
|
||||
0x02231ea8 id=0x07 fn=0xe0040914 MCU_EXT_CMD_PM_STATE_CTRL
|
||||
0x02231eb0 id=0x25 fn=0xf0097174 MCU_EXT_CMD_STA_REC_UPDATE
|
||||
0x02231eb8 id=0x26 fn=0xe0092848 MCU_EXT_CMD_BSS_INFO_UPDATE
|
||||
0x02231ec0 id=0x2a fn=0xe00928c6 (MTK-internal id)
|
||||
0x02231ec8 id=0xbf fn=0xe009277c (MTK-internal id)
|
||||
0x02231ed0 id=0x13 fn=0xe0042006 MCU_EXT_CMD_FW_LOG_2_HOST
|
||||
0x02231ed8 id=0x27 fn=0xe005e710 MCU_EXT_CMD_EDCA_UPDATE
|
||||
0x02231ee0 id=0x28 fn=0xe0060b5e (MTK-internal id)
|
||||
0x02231ee8 id=0x47 fn=0xe005f636 MCU_EXT_CMD_RX_HDR_TRANS
|
||||
0x02231ef0 id=0x48 fn=0xe005f796 MCU_EXT_CMD_MUAR_UPDATE
|
||||
0x02231ef8 id=0x93 fn=0xe005f5ae (MTK-internal id)
|
||||
0x02231f00 id=0x32 fn=0xe00402fa MCU_EXT_CMD_WTBL_UPDATE
|
||||
0x02231f08 id=0x49 fn=0xe003ee7e MCU_EXT_CMD_BCN_OFFLOAD
|
||||
0x02231f10 id=0xa6 fn=0xe005db74 (MTK-internal id)
|
||||
0x02231f18 id=0xae fn=0xe005f706 (MTK-internal id)
|
||||
0x02231f20 id=0x95 fn=0xe004297c MCU_EXT_CMD_FW_DBG_CTRL
|
||||
0x02231f28 id=0x81 fn=0xe005d480 MCU_EXT_CMD_SET_SER_TRIGGER
|
||||
0x02231f30 id=0x57 fn=0xe0042558 (MTK-internal id)
|
||||
0x02231f38 id=0x9c fn=0xe0043588 (MTK-internal id)
|
||||
0x02231f40 id=0x94 fn=0xe0040de4 MCU_EXT_CMD_TWT_AGRT_UPDATE
|
||||
0x02231f48 id=0x02 fn=0xe007fade MCU_EXT_CMD_DEV_INFO_UPDATE
|
||||
0x02231f50 id=0xb7 fn=0xe0042f70 (MTK-internal id)
|
||||
0x02231f58 id=0xc4 fn=0xe0043248 (MTK-internal id)
|
||||
0x02231f60 id=0x98 fn=0xe0061e48 (MTK-internal id)
|
||||
0x02231f68 id=0x42 fn=0xe005f5ec (MTK-internal id)
|
||||
0x02231f70 id=0x50 fn=0xe0047c90 (MTK-internal id)
|
||||
0x02231f78 id=0x5a fn=0xe004166c MCU_EXT_CMD_GET_MIB_INFO
|
||||
0x02231f80 id=0x3c fn=0xe00414ec (MTK-internal id)
|
||||
0x02231f88 id=0x1e fn=0xe00663b2 MCU_EXT_CMD_TXBF_ACTION
|
||||
0x02231f90 id=0x36 fn=0xe0062e16 MCU_EXT_CMD_SET_DRR_CTRL
|
||||
0x02231f98 id=0x38 fn=0xe00640fe (MTK-internal id)
|
||||
0x02231fa0 id=0x37 fn=0xe0062b62 (MTK-internal id)
|
||||
0x02231fa8 id=0x4b fn=0xe0062bfe (MTK-internal id)
|
||||
0x02231fb0 id=0x4a fn=0xe0062eae MCU_EXT_CMD_RX_AIRTIME_CTRL
|
||||
0x02231fb8 id=0x67 fn=0xe0064714 MCU_EXT_CMD_CAL_CACHE
|
||||
0x02231fc0 id=0x68 fn=0xe0063182 MCU_EXT_CMD_RED_ENABLE
|
||||
0x02231fc8 id=0x6b fn=0xe00645da (MTK-internal id)
|
||||
0x02231fd0 id=0x01 fn=0xe0090b8a MCU_EXT_CMD_EFUSE_ACCESS
|
||||
# 31-entry {id,fn} array @ 0x02231fe0 (r5_t0_a02229800.bin)
|
||||
0x02231fe0 id=0x04 fn=0xe008a8ae MCU_EXT_CMD_RF_TEST
|
||||
0x02231fe8 id=0x08 fn=0xe0080680 MCU_EXT_CMD_CHANNEL_SWITCH
|
||||
0x02231ff0 id=0x4e fn=0xe0080680 MCU_EXT_CMD_SET_RX_PATH
|
||||
0x02231ff8 id=0x4f fn=0xe00897a0 MCU_EXT_CMD_EFUSE_FREE_BLOCK
|
||||
0x02232000 id=0x19 fn=0xe00918a0 (MTK-internal id)
|
||||
0x02232008 id=0x1f fn=0xe007d684 (MTK-internal id)
|
||||
0x02232010 id=0x21 fn=0xe00804ac MCU_EXT_CMD_EFUSE_BUFFER_MODE
|
||||
0x02232018 id=0x9b fn=0xe007ee5e (MTK-internal id)
|
||||
0x02232020 id=0xbe fn=0xe007ef44 (MTK-internal id)
|
||||
0x02232028 id=0x24 fn=0xe00407aa (MTK-internal id)
|
||||
0x02232030 id=0x2c fn=0xe008bf86 MCU_EXT_CMD_THERMAL_CTRL
|
||||
0x02232038 id=0x30 fn=0xe007a9b2 (MTK-internal id)
|
||||
0x02232040 id=0x79 fn=0xe0080b88 (MTK-internal id)
|
||||
0x02232048 id=0x17 fn=0xe0042d38 (MTK-internal id)
|
||||
0x02232050 id=0x82 fn=0xe0082128 (MTK-internal id)
|
||||
0x02232058 id=0x3d fn=0xe008a938 MCU_EXT_CMD_ATE_CTRL
|
||||
0x02232060 id=0x3e fn=0xe0081686 MCU_EXT_CMD_PROTECT_CTRL
|
||||
0x02232068 id=0x9f fn=0xe0045f3c MCU_EXT_CMD_MURU_CTRL
|
||||
0x02232070 id=0x87 fn=0x0221cf98 (MTK-internal id)
|
||||
0x02232078 id=0x3a fn=0xe007ce40 MCU_EXT_CMD_SET_RDD_CTRL
|
||||
0x02232080 id=0xa3 fn=0xe007cb80 (MTK-internal id)
|
||||
0x02232088 id=0xc5 fn=0xe007cd20 (MTK-internal id)
|
||||
0x02232090 id=0x9d fn=0xe007c0c0 MCU_EXT_CMD_SET_RDD_TH
|
||||
0x02232098 id=0xb2 fn=0xe007c138 (MTK-internal id)
|
||||
0x022320a0 id=0x46 fn=0xe004174a MCU_EXT_CMD_MAC_INIT_CTRL
|
||||
0x022320a8 id=0x44 fn=0xe0048392 (MTK-internal id)
|
||||
0x022320b0 id=0x43 fn=0xe004197c (MTK-internal id)
|
||||
0x022320b8 id=0x23 fn=0xe008bca8 MCU_EXT_CMD_THERMAL_PROT
|
||||
0x022320c0 id=0x56 fn=0xe006cf68 (MTK-internal id)
|
||||
0x022320c8 id=0x58 fn=0xe008cf2a MCU_EXT_CMD_TX_POWER_FEATURE_CTRL
|
||||
0x022320d0 id=0xa1 fn=0xe00419c6 (MTK-internal id)
|
||||
# 24-entry {id,fn} array @ 0x022320e0 (r5_t0_a02229800.bin)
|
||||
0x022320e0 id=0xad fn=0xe00779ac MCU_EXT_CMD_PHY_STAT_INFO
|
||||
0x022320e8 id=0xb5 fn=0xe0077e68 (MTK-internal id)
|
||||
0x022320f0 id=0x73 fn=0xe0040778 (MTK-internal id)
|
||||
0x022320f8 id=0x9a fn=0xe0080024 MCU_EXT_CMD_OFFCH_SCAN_CTRL
|
||||
0x02232100 id=0xab fn=0xe008a67c MCU_EXT_CMD_GROUP_PRE_CAL_INFO
|
||||
0x02232108 id=0xac fn=0xe008a6ce MCU_EXT_CMD_DPD_PRE_CAL_INFO
|
||||
0x02232110 id=0xa8 fn=0xe0083ede MCU_EXT_CMD_SET_SPR
|
||||
0x02232118 id=0xa4 fn=0xe008aadc (MTK-internal id)
|
||||
0x02232120 id=0xb3 fn=0xe008ae7c (MTK-internal id)
|
||||
0x02232128 id=0xb6 fn=0xe0078664 (MTK-internal id)
|
||||
0x02232130 id=0xb8 fn=0xe0048010 (MTK-internal id)
|
||||
0x02232138 id=0xb9 fn=0xe007944c (MTK-internal id)
|
||||
0x02232140 id=0xba fn=0xe00814f0 (MTK-internal id)
|
||||
0x02232148 id=0xc8 fn=0xe00419fc (MTK-internal id)
|
||||
0x02232150 id=0x7a fn=0xe0041a42 (MTK-internal id)
|
||||
0x02232158 id=0x7b fn=0xe00417d0 (MTK-internal id)
|
||||
0x02232160 id=0x7c fn=0xe0041854 MCU_EXT_CMD_SET_RADAR_TH
|
||||
0x02232168 id=0xc6 fn=0xe00418ae (MTK-internal id)
|
||||
0x02232170 id=0xc7 fn=0xe0041702 (MTK-internal id)
|
||||
0x02232178 id=0xc0 fn=0xe007ebc0 (MTK-internal id)
|
||||
0x02232180 id=0xc2 fn=0xe00482e4 (MTK-internal id)
|
||||
0x02232188 id=0xd5 fn=0xe005dde4 (MTK-internal id)
|
||||
0x02232190 id=0x0f fn=0xe0046e14 (MTK-internal id)
|
||||
0x02232198 id=0x5b fn=0xe0081550 (MTK-internal id)
|
||||
# 43-entry {id,fn} array @ 0x022324ec (r5_t0_a02229800.bin)
|
||||
0x022324ec id=0x01 fn=0xe0045a7e MCU_EXT_CMD_EFUSE_ACCESS
|
||||
0x022324f4 id=0x06 fn=0xe0043b36 (MTK-internal id)
|
||||
0x022324fc id=0x0b fn=0xe0043c6c (MTK-internal id)
|
||||
0x02232504 id=0x14 fn=0xe00452b6 (MTK-internal id)
|
||||
0x0223250c id=0x15 fn=0xe0043990 (MTK-internal id)
|
||||
0x02232514 id=0x0c fn=0xe0043884 (MTK-internal id)
|
||||
0x0223251c id=0x0d fn=0xe0043ba0 (MTK-internal id)
|
||||
0x02232524 id=0x0e fn=0xe0044aec (MTK-internal id)
|
||||
0x0223252c id=0x0f fn=0xe0043dc2 (MTK-internal id)
|
||||
0x02232534 id=0x10 fn=0xe0044092 (MTK-internal id)
|
||||
0x0223253c id=0x11 fn=0xe0045950 MCU_EXT_CMD_SET_TX_POWER_CTRL
|
||||
0x02232544 id=0x12 fn=0xe0044b00 (MTK-internal id)
|
||||
0x0223254c id=0x13 fn=0xe0043c06 MCU_EXT_CMD_FW_LOG_2_HOST
|
||||
0x02232554 id=0x33 fn=0xe0043e1a (MTK-internal id)
|
||||
0x0223255c id=0x18 fn=0xe00440ac (MTK-internal id)
|
||||
0x02232564 id=0x19 fn=0xe0043a7a (MTK-internal id)
|
||||
0x0223256c id=0x1a fn=0xe00441ac (MTK-internal id)
|
||||
0x02232574 id=0x1b fn=0xe00441c8 (MTK-internal id)
|
||||
0x0223257c id=0x50 fn=0xe00439a0 (MTK-internal id)
|
||||
0x02232584 id=0x51 fn=0xe004552a (MTK-internal id)
|
||||
0x0223258c id=0x64 fn=0xe004432a (MTK-internal id)
|
||||
0x02232594 id=0x65 fn=0xe0043e58 (MTK-internal id)
|
||||
0x0223259c id=0x66 fn=0xe0043b1c (MTK-internal id)
|
||||
0x022325a4 id=0x67 fn=0xe0043cbe MCU_EXT_CMD_CAL_CACHE
|
||||
0x022325ac id=0x68 fn=0xe0043ec2 MCU_EXT_CMD_RED_ENABLE
|
||||
0x022325b4 id=0x69 fn=0xe0043a00 (MTK-internal id)
|
||||
0x022325bc id=0x6a fn=0xe0043a1a (MTK-internal id)
|
||||
0x022325c4 id=0xc8 fn=0xe0044292 (MTK-internal id)
|
||||
0x022325cc id=0xc9 fn=0xe00442c0 (MTK-internal id)
|
||||
0x022325d4 id=0xca fn=0xe0043a42 (MTK-internal id)
|
||||
0x022325dc id=0xcb fn=0xe0044b10 (MTK-internal id)
|
||||
0x022325e4 id=0xcc fn=0xe0043a64 (MTK-internal id)
|
||||
0x022325ec id=0xcd fn=0xe0043aa6 (MTK-internal id)
|
||||
0x022325f4 id=0xd2 fn=0xe0043f1a (MTK-internal id)
|
||||
0x022325fc id=0xd3 fn=0xe0043f4a (MTK-internal id)
|
||||
0x02232604 id=0xd0 fn=0xe0043f8c (MTK-internal id)
|
||||
0x0223260c id=0xd1 fn=0xe0043fbc (MTK-internal id)
|
||||
0x02232614 id=0x96 fn=0xe0043abc (MTK-internal id)
|
||||
0x0223261c id=0x97 fn=0xe00441ee (MTK-internal id)
|
||||
0x02232624 id=0xd4 fn=0xe0043fec (MTK-internal id)
|
||||
0x0223262c id=0xfe fn=0xe0044bde (MTK-internal id)
|
||||
0x02232634 id=0xce fn=0xe0043d32 (MTK-internal id)
|
||||
0x0223263c id=0xcf fn=0xe0043aca (MTK-internal id)
|
||||
# 8-entry {id,fn} array @ 0x0223670c (r5_t0_a02229800.bin)
|
||||
0x0223670c id=0x00 fn=0xe0077a2c (MTK-internal id)
|
||||
0x02236714 id=0x01 fn=0xe0077a5c MCU_EXT_CMD_EFUSE_ACCESS
|
||||
0x0223671c id=0x02 fn=0xe007758c MCU_EXT_CMD_DEV_INFO_UPDATE
|
||||
0x02236724 id=0x03 fn=0xe007747c (MTK-internal id)
|
||||
0x0223672c id=0x04 fn=0xe0077aa2 MCU_EXT_CMD_RF_TEST
|
||||
0x02236734 id=0x05 fn=0xe00776a8 MCU_EXT_CMD_ID_RADIO_ON_OFF_CTRL
|
||||
0x0223673c id=0x06 fn=0xe0077478 (MTK-internal id)
|
||||
0x02236744 id=0x07 fn=0xe00776b6 MCU_EXT_CMD_PM_STATE_CTRL
|
||||
# 92-entry {id,fn} array @ 0x02236bf0 (r5_t0_a02229800.bin)
|
||||
0x02236bf0 id=0x01 fn=0xe0083c88 MCU_EXT_CMD_EFUSE_ACCESS
|
||||
0x02236bf8 id=0x02 fn=0xe00844f2 MCU_EXT_CMD_DEV_INFO_UPDATE
|
||||
0x02236c00 id=0x03 fn=0xe00838c6 (MTK-internal id)
|
||||
0x02236c08 id=0x04 fn=0xe008453c MCU_EXT_CMD_RF_TEST
|
||||
0x02236c10 id=0x05 fn=0xe0083aa0 MCU_EXT_CMD_ID_RADIO_ON_OFF_CTRL
|
||||
0x02236c18 id=0x06 fn=0xe008461a (MTK-internal id)
|
||||
0x02236c20 id=0x07 fn=0xe0083d1e MCU_EXT_CMD_PM_STATE_CTRL
|
||||
0x02236c28 id=0x08 fn=0xe0084666 MCU_EXT_CMD_CHANNEL_SWITCH
|
||||
0x02236c30 id=0x09 fn=0xe0083d62 (MTK-internal id)
|
||||
0x02236c38 id=0x0a fn=0xe00846b2 (MTK-internal id)
|
||||
0x02236c40 id=0x0b fn=0xe00838dc (MTK-internal id)
|
||||
0x02236c48 id=0x0c fn=0xe0084586 (MTK-internal id)
|
||||
0x02236c50 id=0x0d fn=0xe00838f2 (MTK-internal id)
|
||||
0x02236c58 id=0x0e fn=0xe00845d0 (MTK-internal id)
|
||||
0x02236c60 id=0x0f fn=0xe0083908 (MTK-internal id)
|
||||
0x02236c68 id=0x10 fn=0xe00846fe (MTK-internal id)
|
||||
0x02236c70 id=0x11 fn=0xe008391a MCU_EXT_CMD_SET_TX_POWER_CTRL
|
||||
0x02236c78 id=0x12 fn=0xe0084748 (MTK-internal id)
|
||||
0x02236c80 id=0x13 fn=0xe008392c MCU_EXT_CMD_FW_LOG_2_HOST
|
||||
0x02236c88 id=0x14 fn=0xe0084792 (MTK-internal id)
|
||||
0x02236c90 id=0x15 fn=0xe008393e (MTK-internal id)
|
||||
0x02236c98 id=0x16 fn=0xe00847dc (MTK-internal id)
|
||||
0x02236ca0 id=0x17 fn=0xe0083950 (MTK-internal id)
|
||||
0x02236ca8 id=0x18 fn=0xe0084826 (MTK-internal id)
|
||||
0x02236cb0 id=0x19 fn=0xe0083962 (MTK-internal id)
|
||||
0x02236cb8 id=0x1a fn=0xe008486e (MTK-internal id)
|
||||
0x02236cc0 id=0x1b fn=0xe0083974 (MTK-internal id)
|
||||
0x02236cc8 id=0x1c fn=0xe00848b8 (MTK-internal id)
|
||||
0x02236cd0 id=0x1d fn=0xe0083986 (MTK-internal id)
|
||||
0x02236cd8 id=0x1e fn=0xe0084902 MCU_EXT_CMD_TXBF_ACTION
|
||||
0x02236ce0 id=0x1f fn=0xe0083998 (MTK-internal id)
|
||||
0x02236ce8 id=0x20 fn=0xe008494c (MTK-internal id)
|
||||
0x02236cf0 id=0x21 fn=0xe00839aa MCU_EXT_CMD_EFUSE_BUFFER_MODE
|
||||
0x02236cf8 id=0x22 fn=0xe0084996 (MTK-internal id)
|
||||
0x02236d00 id=0x23 fn=0xe00839c2 MCU_EXT_CMD_THERMAL_PROT
|
||||
0x02236d08 id=0x24 fn=0xe00849e2 (MTK-internal id)
|
||||
0x02236d10 id=0x25 fn=0xe00839da MCU_EXT_CMD_STA_REC_UPDATE
|
||||
0x02236d18 id=0x26 fn=0xe0084a2e MCU_EXT_CMD_BSS_INFO_UPDATE
|
||||
0x02236d20 id=0x27 fn=0xe00839f2 MCU_EXT_CMD_EDCA_UPDATE
|
||||
0x02236d28 id=0x28 fn=0xe0084a7a (MTK-internal id)
|
||||
0x02236d30 id=0x29 fn=0xe0083db0 (MTK-internal id)
|
||||
0x02236d38 id=0x2a fn=0xe0084ac6 (MTK-internal id)
|
||||
0x02236d40 id=0x2b fn=0xe0083d8e (MTK-internal id)
|
||||
0x02236d48 id=0x2c fn=0xe0084b12 MCU_EXT_CMD_THERMAL_CTRL
|
||||
0x02236d50 id=0x2d fn=0xe0083a20 (MTK-internal id)
|
||||
0x02236d58 id=0x2e fn=0xe0084b5e (MTK-internal id)
|
||||
0x02236d60 id=0x31 fn=0xe0083a38 (MTK-internal id)
|
||||
0x02236d68 id=0x32 fn=0xe0084baa MCU_EXT_CMD_WTBL_UPDATE
|
||||
0x02236d70 id=0x33 fn=0xe0083a50 (MTK-internal id)
|
||||
0x02236d78 id=0x34 fn=0xe0084bf6 (MTK-internal id)
|
||||
0x02236d80 id=0x80 fn=0xe0083ddc MCU_EXT_CMD_MWDS_SUPPORT
|
||||
0x02236d88 id=0x81 fn=0xe0084d06 MCU_EXT_CMD_SET_SER_TRIGGER
|
||||
0x02236d90 id=0x82 fn=0xe0083ccc (MTK-internal id)
|
||||
0x02236d98 id=0x83 fn=0xe0084c42 (MTK-internal id)
|
||||
0x02236da0 id=0x84 fn=0xe0084cae (MTK-internal id)
|
||||
0x02236da8 id=0x85 fn=0xe008385c (MTK-internal id)
|
||||
0x02236db0 id=0x86 fn=0xe0083884 (MTK-internal id)
|
||||
0x02236db8 id=0x87 fn=0xe0083b6a (MTK-internal id)
|
||||
0x02236dc0 id=0x88 fn=0xe0083fc2 (MTK-internal id)
|
||||
0x02236dc8 id=0x89 fn=0xe0083cec (MTK-internal id)
|
||||
0x02236dd0 id=0x8a fn=0xe0084d5a (MTK-internal id)
|
||||
0x02236dd8 id=0xc0 fn=0xe0083b10 (MTK-internal id)
|
||||
0x02236de0 id=0xc1 fn=0xe00840cc (MTK-internal id)
|
||||
0x02236de8 id=0xc2 fn=0xe0083b24 (MTK-internal id)
|
||||
0x02236df0 id=0xc3 fn=0xe0084112 (MTK-internal id)
|
||||
0x02236df8 id=0xc4 fn=0xe0083ba0 (MTK-internal id)
|
||||
0x02236e00 id=0xc5 fn=0xe00841a0 (MTK-internal id)
|
||||
0x02236e08 id=0xc6 fn=0xe0083bb4 (MTK-internal id)
|
||||
0x02236e10 id=0xc7 fn=0xe00841e6 (MTK-internal id)
|
||||
0x02236e18 id=0xc8 fn=0xe0083bc8 (MTK-internal id)
|
||||
0x02236e20 id=0xc9 fn=0xe008422c (MTK-internal id)
|
||||
0x02236e28 id=0xca fn=0xe0083bdc (MTK-internal id)
|
||||
0x02236e30 id=0xcb fn=0xe0084272 (MTK-internal id)
|
||||
0x02236e38 id=0xcc fn=0xe0083bf0 (MTK-internal id)
|
||||
0x02236e40 id=0xcd fn=0xe00842b8 (MTK-internal id)
|
||||
0x02236e48 id=0xce fn=0xe0083f4e (MTK-internal id)
|
||||
0x02236e50 id=0xcf fn=0xe00842fe (MTK-internal id)
|
||||
0x02236e58 id=0xd0 fn=0xe0083c1a (MTK-internal id)
|
||||
0x02236e60 id=0xd1 fn=0xe0084394 (MTK-internal id)
|
||||
0x02236e68 id=0xd2 fn=0xe0083c04 (MTK-internal id)
|
||||
0x02236e70 id=0xd3 fn=0xe0083aec (MTK-internal id)
|
||||
0x02236e78 id=0xd4 fn=0xe0084158 (MTK-internal id)
|
||||
0x02236e80 id=0xd5 fn=0xe0083c2e (MTK-internal id)
|
||||
0x02236e88 id=0xd6 fn=0xe00843da (MTK-internal id)
|
||||
0x02236e90 id=0xd7 fn=0xe0083c42 (MTK-internal id)
|
||||
0x02236e98 id=0xd8 fn=0xe0084420 (MTK-internal id)
|
||||
0x02236ea0 id=0xd9 fn=0xe0083c56 (MTK-internal id)
|
||||
0x02236ea8 id=0xda fn=0xe0084466 (MTK-internal id)
|
||||
0x02236eb0 id=0xdb fn=0xe00844ac (MTK-internal id)
|
||||
0x02236eb8 id=0xdc fn=0xe0083c6a (MTK-internal id)
|
||||
0x02236ec0 id=0xdd fn=0xe0084346 (MTK-internal id)
|
||||
0x02236ec8 id=0xea fn=0xe0083a6a (MTK-internal id)
|
||||
# 10-entry {id,fn} array @ 0x0223833c (r5_t0_a02229800.bin)
|
||||
0x0223833c id=0x00 fn=0xe008f91e (MTK-internal id)
|
||||
0x02238344 id=0x01 fn=0xe008f068 MCU_EXT_CMD_EFUSE_ACCESS
|
||||
0x0223834c id=0x02 fn=0xe008f080 MCU_EXT_CMD_DEV_INFO_UPDATE
|
||||
0x02238354 id=0x03 fn=0xe008f098 (MTK-internal id)
|
||||
0x0223835c id=0x04 fn=0xe008f18e MCU_EXT_CMD_RF_TEST
|
||||
0x02238364 id=0x05 fn=0xe008f1ba MCU_EXT_CMD_ID_RADIO_ON_OFF_CTRL
|
||||
0x0223836c id=0x06 fn=0xe008f1d8 (MTK-internal id)
|
||||
0x02238374 id=0x07 fn=0xe008ee6c MCU_EXT_CMD_PM_STATE_CTRL
|
||||
0x0223837c id=0x08 fn=0xe008f164 MCU_EXT_CMD_CHANNEL_SWITCH
|
||||
0x02238384 id=0x0b fn=0xe008e3e0 (MTK-internal id)
|
||||
# 9-entry {id,fn} array @ 0x02238534 (r5_t0_a02229800.bin)
|
||||
0x02238534 id=0x00 fn=0xe0091a16 (MTK-internal id)
|
||||
0x0223853c id=0x01 fn=0xe0091a8c MCU_EXT_CMD_EFUSE_ACCESS
|
||||
0x02238544 id=0x02 fn=0xe0091aec MCU_EXT_CMD_DEV_INFO_UPDATE
|
||||
0x0223854c id=0x03 fn=0xe0091ee8 (MTK-internal id)
|
||||
0x02238554 id=0x04 fn=0xe009227c MCU_EXT_CMD_RF_TEST
|
||||
0x0223855c id=0x05 fn=0xe0091ba2 MCU_EXT_CMD_ID_RADIO_ON_OFF_CTRL
|
||||
0x02238564 id=0x00 fn=0xe00918f6 (MTK-internal id)
|
||||
0x0223856c id=0x01 fn=0xe00929b0 MCU_EXT_CMD_EFUSE_ACCESS
|
||||
0x02238574 id=0x02 fn=0xe0091c4e MCU_EXT_CMD_DEV_INFO_UPDATE
|
||||
# 10-entry {id,fn} array @ 0x0223858c (r5_t0_a02229800.bin)
|
||||
0x0223858c id=0x07 fn=0xe0091cd8 MCU_EXT_CMD_PM_STATE_CTRL
|
||||
0x02238594 id=0x0a fn=0xe0079520 (MTK-internal id)
|
||||
0x0223859c id=0x0b fn=0xe0091d64 (MTK-internal id)
|
||||
0x022385a4 id=0x0c fn=0xe0091d96 (MTK-internal id)
|
||||
0x022385ac id=0x0d fn=0xe0091de0 (MTK-internal id)
|
||||
0x022385b4 id=0x0e fn=0xe0092690 (MTK-internal id)
|
||||
0x022385bc id=0x0f fn=0xe00924a0 (MTK-internal id)
|
||||
0x022385c4 id=0x10 fn=0xe0092568 (MTK-internal id)
|
||||
0x022385cc id=0x11 fn=0xe003f5d4 MCU_EXT_CMD_SET_TX_POWER_CTRL
|
||||
0x022385d4 id=0x1b fn=0xe00925d4 (MTK-internal id)
|
||||
# 49-entry {id,fn} array @ 0x02238a5c (r5_t0_a02229800.bin)
|
||||
0x02238a5c id=0x00 fn=0xe00af53c (MTK-internal id)
|
||||
0x02238a64 id=0x01 fn=0xe00af544 MCU_EXT_CMD_EFUSE_ACCESS
|
||||
0x02238a6c id=0x02 fn=0xe00af54c MCU_EXT_CMD_DEV_INFO_UPDATE
|
||||
0x02238a74 id=0x03 fn=0xe00af554 (MTK-internal id)
|
||||
0x02238a7c id=0x00 fn=0xe00af578 (MTK-internal id)
|
||||
0x02238a84 id=0x01 fn=0xe00af55c MCU_EXT_CMD_EFUSE_ACCESS
|
||||
0x02238a8c id=0x02 fn=0xe00af568 MCU_EXT_CMD_DEV_INFO_UPDATE
|
||||
0x02238a94 id=0x03 fn=0xe00af574 (MTK-internal id)
|
||||
0x02238a9c id=0x04 fn=0xe00af580 MCU_EXT_CMD_RF_TEST
|
||||
0x02238aa4 id=0x05 fn=0xe00af58c MCU_EXT_CMD_ID_RADIO_ON_OFF_CTRL
|
||||
0x02238aac id=0x06 fn=0xe00af598 (MTK-internal id)
|
||||
0x02238ab4 id=0x07 fn=0xe00af5a8 MCU_EXT_CMD_PM_STATE_CTRL
|
||||
0x02238abc id=0x11 fn=0xe00af5b8 MCU_EXT_CMD_SET_TX_POWER_CTRL
|
||||
0x02238ac4 id=0x13 fn=0xe00af5c4 MCU_EXT_CMD_FW_LOG_2_HOST
|
||||
0x02238acc id=0x16 fn=0xe00af5d0 (MTK-internal id)
|
||||
0x02238ad4 id=0x17 fn=0xe00af5e0 (MTK-internal id)
|
||||
0x02238adc id=0x00 fn=0xe00af5f0 (MTK-internal id)
|
||||
0x02238ae4 id=0x01 fn=0xe00af604 MCU_EXT_CMD_EFUSE_ACCESS
|
||||
0x02238aec id=0x02 fn=0xe00af61c MCU_EXT_CMD_DEV_INFO_UPDATE
|
||||
0x02238af4 id=0x03 fn=0xe00af630 (MTK-internal id)
|
||||
0x02238afc id=0x04 fn=0xe00af644 MCU_EXT_CMD_RF_TEST
|
||||
0x02238b04 id=0x05 fn=0xe00af658 MCU_EXT_CMD_ID_RADIO_ON_OFF_CTRL
|
||||
0x02238b0c id=0x06 fn=0xe00af670 (MTK-internal id)
|
||||
0x02238b14 id=0x07 fn=0xe00af604 MCU_EXT_CMD_PM_STATE_CTRL
|
||||
0x02238b1c id=0x08 fn=0xe00af5f0 MCU_EXT_CMD_CHANNEL_SWITCH
|
||||
0x02238b24 id=0x09 fn=0xe00af670 (MTK-internal id)
|
||||
0x02238b2c id=0x0a fn=0xe00af604 (MTK-internal id)
|
||||
0x02238b34 id=0x0b fn=0xe00af604 (MTK-internal id)
|
||||
0x02238b3c id=0x00 fn=0xe00af684 (MTK-internal id)
|
||||
0x02238b44 id=0x01 fn=0xe00af690 MCU_EXT_CMD_EFUSE_ACCESS
|
||||
0x02238b4c id=0x02 fn=0xe00af69c MCU_EXT_CMD_DEV_INFO_UPDATE
|
||||
0x02238b54 id=0x03 fn=0xe00af6b0 (MTK-internal id)
|
||||
0x02238b5c id=0x0d fn=0xe00af6b8 (MTK-internal id)
|
||||
0x02238b64 id=0x0e fn=0xe00af6c0 (MTK-internal id)
|
||||
0x02238b6c id=0x0f fn=0xe00af6c8 (MTK-internal id)
|
||||
0x02238b74 id=0x10 fn=0xe00af6d0 (MTK-internal id)
|
||||
0x02238b7c id=0x00 fn=0xe00af6d4 (MTK-internal id)
|
||||
0x02238b84 id=0x01 fn=0xe00a68d0 MCU_EXT_CMD_EFUSE_ACCESS
|
||||
0x02238b8c id=0x02 fn=0xe00af6d0 MCU_EXT_CMD_DEV_INFO_UPDATE
|
||||
0x02238b94 id=0x03 fn=0xe00af6e4 (MTK-internal id)
|
||||
0x02238b9c id=0x04 fn=0xe00a6988 MCU_EXT_CMD_RF_TEST
|
||||
0x02238ba4 id=0x05 fn=0xe00af6e8 MCU_EXT_CMD_ID_RADIO_ON_OFF_CTRL
|
||||
0x02238bac id=0x06 fn=0xe00af6ec (MTK-internal id)
|
||||
0x02238bb4 id=0x07 fn=0xe00af6fc MCU_EXT_CMD_PM_STATE_CTRL
|
||||
0x02238bbc id=0x08 fn=0xe00af704 MCU_EXT_CMD_CHANNEL_SWITCH
|
||||
0x02238bc4 id=0x09 fn=0xe00af714 (MTK-internal id)
|
||||
0x02238bcc id=0x0a fn=0xe00af71c (MTK-internal id)
|
||||
0x02238bd4 id=0x0b fn=0xe00af728 (MTK-internal id)
|
||||
0x02238bdc id=0x0c fn=0xe00af734 (MTK-internal id)
|
||||
# 33-entry {id,fn} array @ 0x02238e44 (r5_t0_a02229800.bin)
|
||||
0x02238e44 id=0x00 fn=0xe003e66e (MTK-internal id)
|
||||
0x02238e4c id=0x01 fn=0xe003e696 MCU_EXT_CMD_EFUSE_ACCESS
|
||||
0x02238e54 id=0x16 fn=0xe003c370 (MTK-internal id)
|
||||
0x02238e5c id=0x17 fn=0xe003c370 (MTK-internal id)
|
||||
0x02238e64 id=0x18 fn=0xe003c370 (MTK-internal id)
|
||||
0x02238e6c id=0x19 fn=0xe003c370 (MTK-internal id)
|
||||
0x02238e74 id=0x28 fn=0xe003c63e (MTK-internal id)
|
||||
0x02238e7c id=0x2b fn=0xe003c63e (MTK-internal id)
|
||||
0x02238e84 id=0x00 fn=0xe003c3aa (MTK-internal id)
|
||||
0x02238e8c id=0x29 fn=0xe003c3ac (MTK-internal id)
|
||||
0x02238e94 id=0x1a fn=0xe003c028 (MTK-internal id)
|
||||
0x02238e9c id=0x1b fn=0xe003c028 (MTK-internal id)
|
||||
0x02238ea4 id=0x1c fn=0xe003c028 (MTK-internal id)
|
||||
0x02238eac id=0x1d fn=0xe003c028 (MTK-internal id)
|
||||
0x02238eb4 id=0x12 fn=0xe003c34c (MTK-internal id)
|
||||
0x02238ebc id=0x13 fn=0xe003c34c MCU_EXT_CMD_FW_LOG_2_HOST
|
||||
0x02238ec4 id=0x14 fn=0xe003c34c (MTK-internal id)
|
||||
0x02238ecc id=0x15 fn=0xe003c34c (MTK-internal id)
|
||||
0x02238ed4 id=0x06 fn=0xe003c012 (MTK-internal id)
|
||||
0x02238edc id=0x07 fn=0xe003c012 MCU_EXT_CMD_PM_STATE_CTRL
|
||||
0x02238ee4 id=0x08 fn=0xe003c012 MCU_EXT_CMD_CHANNEL_SWITCH
|
||||
0x02238eec id=0x09 fn=0xe003c012 (MTK-internal id)
|
||||
0x02238ef4 id=0x0a fn=0xe003c012 (MTK-internal id)
|
||||
0x02238efc id=0x0b fn=0xe003c012 (MTK-internal id)
|
||||
0x02238f04 id=0x0c fn=0xe003c012 (MTK-internal id)
|
||||
0x02238f0c id=0x0d fn=0xe003c012 (MTK-internal id)
|
||||
0x02238f14 id=0x2e fn=0xe003e624 (MTK-internal id)
|
||||
0x02238f1c id=0x2f fn=0xe003e624 (MTK-internal id)
|
||||
0x02238f24 id=0x01 fn=0xe003e586 MCU_EXT_CMD_EFUSE_ACCESS
|
||||
0x02238f2c id=0x02 fn=0xe003e586 MCU_EXT_CMD_DEV_INFO_UPDATE
|
||||
0x02238f34 id=0x03 fn=0xe003e586 (MTK-internal id)
|
||||
0x02238f3c id=0x04 fn=0xe003e586 MCU_EXT_CMD_RF_TEST
|
||||
0x02238f44 id=0x23 fn=0xe003c38c MCU_EXT_CMD_THERMAL_PROT
|
||||
# 9-entry {id,fn} array @ 0x02238f74 (r5_t0_a02229800.bin)
|
||||
0x02238f74 id=0xef fn=0xe0041460 (MTK-internal id)
|
||||
0x02238f7c id=0xed fn=0xe00412e6 (MTK-internal id)
|
||||
0x02238f84 id=0x04 fn=0xe0040680 MCU_EXT_CMD_RF_TEST
|
||||
0x02238f8c id=0x02 fn=0xe0042ebe MCU_EXT_CMD_DEV_INFO_UPDATE
|
||||
0x02238f94 id=0x8d fn=0xe004276c (MTK-internal id)
|
||||
0x02238f9c id=0x10 fn=0xe0043330 (MTK-internal id)
|
||||
0x02238fa4 id=0x4b fn=0xe00433fa (MTK-internal id)
|
||||
0x02238fac id=0x7d fn=0xe004375c MCU_EXT_CMD_SET_RDD_PATTERN
|
||||
0x02238fb4 id=0xfc fn=0xe00437a4 (MTK-internal id)
|
||||
# 13-entry {id,fn} array @ 0x02238ffc (r5_t0_a02229800.bin)
|
||||
0x02238ffc id=0x06 fn=0xf009b6d6 (MTK-internal id)
|
||||
0x02239004 id=0x07 fn=0xf009b6d6 MCU_EXT_CMD_PM_STATE_CTRL
|
||||
0x0223900c id=0x08 fn=0xf009b6d6 MCU_EXT_CMD_CHANNEL_SWITCH
|
||||
0x02239014 id=0x09 fn=0xf009b6d6 (MTK-internal id)
|
||||
0x0223901c id=0x0a fn=0xf009b6d6 (MTK-internal id)
|
||||
0x02239024 id=0x0b fn=0xf009b6d6 (MTK-internal id)
|
||||
0x0223902c id=0x0c fn=0xf009b6d6 (MTK-internal id)
|
||||
0x02239034 id=0x0d fn=0xf009b6d6 (MTK-internal id)
|
||||
0x0223903c id=0x0e fn=0xf009b6d6 (MTK-internal id)
|
||||
0x02239044 id=0x0f fn=0xf009b6d6 (MTK-internal id)
|
||||
0x0223904c id=0x10 fn=0xe006946e (MTK-internal id)
|
||||
0x02239054 id=0x11 fn=0xe003d7b4 MCU_EXT_CMD_SET_TX_POWER_CTRL
|
||||
0x0223905c id=0x12 fn=0xe00471f6 (MTK-internal id)
|
||||
422
dataset/wm_registrations.txt
Normal file
422
dataset/wm_registrations.txt
Normal file
|
|
@ -0,0 +1,422 @@
|
|||
# 9-entry {id,fn} array @ 0x02231ba8 (r5_t0_a02229800.bin)
|
||||
0x02231ba8 id=0x00 fn=0xf009707c
|
||||
0x02231bb0 id=0x09 fn=0xf00963a6
|
||||
0x02231bb8 id=0x0a fn=0xf0096430
|
||||
0x02231bc0 id=0x0e fn=0xf0096846
|
||||
0x02231bc8 id=0x0d fn=0xe0040280
|
||||
0x02231bd0 id=0x0f fn=0xf0096b72
|
||||
0x02231bd8 id=0x01 fn=0xe00795c8
|
||||
0x02231be0 id=0x03 fn=0xe00799a8
|
||||
0x02231be8 id=0x04 fn=0xe0067480
|
||||
# 29-entry {id,fn} array @ 0x02231bf8 (r5_t0_a02229800.bin)
|
||||
0x02231bf8 id=0x06 fn=0xf00969ca
|
||||
0x02231c00 id=0x0b fn=0xe004649e
|
||||
0x02231c08 id=0x0c fn=0xf0096150
|
||||
0x02231c10 id=0x10 fn=0xf009606e
|
||||
0x02231c18 id=0x11 fn=0xf00961a4
|
||||
0x02231c20 id=0x12 fn=0xe0098294
|
||||
0x02231c28 id=0x14 fn=0xe00660b0
|
||||
0x02231c30 id=0x24 fn=0xf00961f8
|
||||
0x02231c38 id=0x18 fn=0xf0096000
|
||||
0x02231c40 id=0x00 fn=0xe003fae4
|
||||
0x02231c48 id=0x01 fn=0xe003fbe8
|
||||
0x02231c50 id=0x02 fn=0xe003fc4c
|
||||
0x02231c58 id=0x03 fn=0xe003fcb0
|
||||
0x02231c60 id=0x04 fn=0xe003fd14
|
||||
0x02231c68 id=0x05 fn=0xe003fd78
|
||||
0x02231c70 id=0x06 fn=0xe003fda4
|
||||
0x02231c78 id=0x07 fn=0xe003fdda
|
||||
0x02231c80 id=0x08 fn=0xe003ff5c
|
||||
0x02231c88 id=0x09 fn=0xe0040000
|
||||
0x02231c90 id=0x0a fn=0xe0040056
|
||||
0x02231c98 id=0x0c fn=0xe003face
|
||||
0x02231ca0 id=0x0d fn=0xe0040082
|
||||
0x02231ca8 id=0x0e fn=0xe003fae0
|
||||
0x02231cb0 id=0x0f fn=0xe00400ae
|
||||
0x02231cb8 id=0x10 fn=0xe00401b8
|
||||
0x02231cc0 id=0x11 fn=0xe003fe5e
|
||||
0x02231cc8 id=0x13 fn=0xe00401e4
|
||||
0x02231cd0 id=0x12 fn=0xe00401f6
|
||||
0x02231cd8 id=0x15 fn=0xe0040254
|
||||
# 38-entry {id,fn} array @ 0x02231ea8 (r5_t0_a02229800.bin)
|
||||
0x02231ea8 id=0x07 fn=0xe0040914
|
||||
0x02231eb0 id=0x25 fn=0xf0097174
|
||||
0x02231eb8 id=0x26 fn=0xe0092848
|
||||
0x02231ec0 id=0x2a fn=0xe00928c6
|
||||
0x02231ec8 id=0xbf fn=0xe009277c
|
||||
0x02231ed0 id=0x13 fn=0xe0042006
|
||||
0x02231ed8 id=0x27 fn=0xe005e710
|
||||
0x02231ee0 id=0x28 fn=0xe0060b5e
|
||||
0x02231ee8 id=0x47 fn=0xe005f636
|
||||
0x02231ef0 id=0x48 fn=0xe005f796
|
||||
0x02231ef8 id=0x93 fn=0xe005f5ae
|
||||
0x02231f00 id=0x32 fn=0xe00402fa
|
||||
0x02231f08 id=0x49 fn=0xe003ee7e
|
||||
0x02231f10 id=0xa6 fn=0xe005db74
|
||||
0x02231f18 id=0xae fn=0xe005f706
|
||||
0x02231f20 id=0x95 fn=0xe004297c
|
||||
0x02231f28 id=0x81 fn=0xe005d480
|
||||
0x02231f30 id=0x57 fn=0xe0042558
|
||||
0x02231f38 id=0x9c fn=0xe0043588
|
||||
0x02231f40 id=0x94 fn=0xe0040de4
|
||||
0x02231f48 id=0x02 fn=0xe007fade
|
||||
0x02231f50 id=0xb7 fn=0xe0042f70
|
||||
0x02231f58 id=0xc4 fn=0xe0043248
|
||||
0x02231f60 id=0x98 fn=0xe0061e48
|
||||
0x02231f68 id=0x42 fn=0xe005f5ec
|
||||
0x02231f70 id=0x50 fn=0xe0047c90
|
||||
0x02231f78 id=0x5a fn=0xe004166c
|
||||
0x02231f80 id=0x3c fn=0xe00414ec
|
||||
0x02231f88 id=0x1e fn=0xe00663b2
|
||||
0x02231f90 id=0x36 fn=0xe0062e16
|
||||
0x02231f98 id=0x38 fn=0xe00640fe
|
||||
0x02231fa0 id=0x37 fn=0xe0062b62
|
||||
0x02231fa8 id=0x4b fn=0xe0062bfe
|
||||
0x02231fb0 id=0x4a fn=0xe0062eae
|
||||
0x02231fb8 id=0x67 fn=0xe0064714
|
||||
0x02231fc0 id=0x68 fn=0xe0063182
|
||||
0x02231fc8 id=0x6b fn=0xe00645da
|
||||
0x02231fd0 id=0x01 fn=0xe0090b8a
|
||||
# 31-entry {id,fn} array @ 0x02231fe0 (r5_t0_a02229800.bin)
|
||||
0x02231fe0 id=0x04 fn=0xe008a8ae
|
||||
0x02231fe8 id=0x08 fn=0xe0080680
|
||||
0x02231ff0 id=0x4e fn=0xe0080680
|
||||
0x02231ff8 id=0x4f fn=0xe00897a0
|
||||
0x02232000 id=0x19 fn=0xe00918a0
|
||||
0x02232008 id=0x1f fn=0xe007d684
|
||||
0x02232010 id=0x21 fn=0xe00804ac
|
||||
0x02232018 id=0x9b fn=0xe007ee5e
|
||||
0x02232020 id=0xbe fn=0xe007ef44
|
||||
0x02232028 id=0x24 fn=0xe00407aa
|
||||
0x02232030 id=0x2c fn=0xe008bf86
|
||||
0x02232038 id=0x30 fn=0xe007a9b2
|
||||
0x02232040 id=0x79 fn=0xe0080b88
|
||||
0x02232048 id=0x17 fn=0xe0042d38
|
||||
0x02232050 id=0x82 fn=0xe0082128
|
||||
0x02232058 id=0x3d fn=0xe008a938
|
||||
0x02232060 id=0x3e fn=0xe0081686
|
||||
0x02232068 id=0x9f fn=0xe0045f3c
|
||||
0x02232070 id=0x87 fn=0x0221cf98
|
||||
0x02232078 id=0x3a fn=0xe007ce40
|
||||
0x02232080 id=0xa3 fn=0xe007cb80
|
||||
0x02232088 id=0xc5 fn=0xe007cd20
|
||||
0x02232090 id=0x9d fn=0xe007c0c0
|
||||
0x02232098 id=0xb2 fn=0xe007c138
|
||||
0x022320a0 id=0x46 fn=0xe004174a
|
||||
0x022320a8 id=0x44 fn=0xe0048392
|
||||
0x022320b0 id=0x43 fn=0xe004197c
|
||||
0x022320b8 id=0x23 fn=0xe008bca8
|
||||
0x022320c0 id=0x56 fn=0xe006cf68
|
||||
0x022320c8 id=0x58 fn=0xe008cf2a
|
||||
0x022320d0 id=0xa1 fn=0xe00419c6
|
||||
# 24-entry {id,fn} array @ 0x022320e0 (r5_t0_a02229800.bin)
|
||||
0x022320e0 id=0xad fn=0xe00779ac
|
||||
0x022320e8 id=0xb5 fn=0xe0077e68
|
||||
0x022320f0 id=0x73 fn=0xe0040778
|
||||
0x022320f8 id=0x9a fn=0xe0080024
|
||||
0x02232100 id=0xab fn=0xe008a67c
|
||||
0x02232108 id=0xac fn=0xe008a6ce
|
||||
0x02232110 id=0xa8 fn=0xe0083ede
|
||||
0x02232118 id=0xa4 fn=0xe008aadc
|
||||
0x02232120 id=0xb3 fn=0xe008ae7c
|
||||
0x02232128 id=0xb6 fn=0xe0078664
|
||||
0x02232130 id=0xb8 fn=0xe0048010
|
||||
0x02232138 id=0xb9 fn=0xe007944c
|
||||
0x02232140 id=0xba fn=0xe00814f0
|
||||
0x02232148 id=0xc8 fn=0xe00419fc
|
||||
0x02232150 id=0x7a fn=0xe0041a42
|
||||
0x02232158 id=0x7b fn=0xe00417d0
|
||||
0x02232160 id=0x7c fn=0xe0041854
|
||||
0x02232168 id=0xc6 fn=0xe00418ae
|
||||
0x02232170 id=0xc7 fn=0xe0041702
|
||||
0x02232178 id=0xc0 fn=0xe007ebc0
|
||||
0x02232180 id=0xc2 fn=0xe00482e4
|
||||
0x02232188 id=0xd5 fn=0xe005dde4
|
||||
0x02232190 id=0x0f fn=0xe0046e14
|
||||
0x02232198 id=0x5b fn=0xe0081550
|
||||
# 43-entry {id,fn} array @ 0x022324ec (r5_t0_a02229800.bin)
|
||||
0x022324ec id=0x01 fn=0xe0045a7e
|
||||
0x022324f4 id=0x06 fn=0xe0043b36
|
||||
0x022324fc id=0x0b fn=0xe0043c6c
|
||||
0x02232504 id=0x14 fn=0xe00452b6
|
||||
0x0223250c id=0x15 fn=0xe0043990
|
||||
0x02232514 id=0x0c fn=0xe0043884
|
||||
0x0223251c id=0x0d fn=0xe0043ba0
|
||||
0x02232524 id=0x0e fn=0xe0044aec
|
||||
0x0223252c id=0x0f fn=0xe0043dc2
|
||||
0x02232534 id=0x10 fn=0xe0044092
|
||||
0x0223253c id=0x11 fn=0xe0045950
|
||||
0x02232544 id=0x12 fn=0xe0044b00
|
||||
0x0223254c id=0x13 fn=0xe0043c06
|
||||
0x02232554 id=0x33 fn=0xe0043e1a
|
||||
0x0223255c id=0x18 fn=0xe00440ac
|
||||
0x02232564 id=0x19 fn=0xe0043a7a
|
||||
0x0223256c id=0x1a fn=0xe00441ac
|
||||
0x02232574 id=0x1b fn=0xe00441c8
|
||||
0x0223257c id=0x50 fn=0xe00439a0
|
||||
0x02232584 id=0x51 fn=0xe004552a
|
||||
0x0223258c id=0x64 fn=0xe004432a
|
||||
0x02232594 id=0x65 fn=0xe0043e58
|
||||
0x0223259c id=0x66 fn=0xe0043b1c
|
||||
0x022325a4 id=0x67 fn=0xe0043cbe
|
||||
0x022325ac id=0x68 fn=0xe0043ec2
|
||||
0x022325b4 id=0x69 fn=0xe0043a00
|
||||
0x022325bc id=0x6a fn=0xe0043a1a
|
||||
0x022325c4 id=0xc8 fn=0xe0044292
|
||||
0x022325cc id=0xc9 fn=0xe00442c0
|
||||
0x022325d4 id=0xca fn=0xe0043a42
|
||||
0x022325dc id=0xcb fn=0xe0044b10
|
||||
0x022325e4 id=0xcc fn=0xe0043a64
|
||||
0x022325ec id=0xcd fn=0xe0043aa6
|
||||
0x022325f4 id=0xd2 fn=0xe0043f1a
|
||||
0x022325fc id=0xd3 fn=0xe0043f4a
|
||||
0x02232604 id=0xd0 fn=0xe0043f8c
|
||||
0x0223260c id=0xd1 fn=0xe0043fbc
|
||||
0x02232614 id=0x96 fn=0xe0043abc
|
||||
0x0223261c id=0x97 fn=0xe00441ee
|
||||
0x02232624 id=0xd4 fn=0xe0043fec
|
||||
0x0223262c id=0xfe fn=0xe0044bde
|
||||
0x02232634 id=0xce fn=0xe0043d32
|
||||
0x0223263c id=0xcf fn=0xe0043aca
|
||||
# 8-entry {id,fn} array @ 0x0223670c (r5_t0_a02229800.bin)
|
||||
0x0223670c id=0x00 fn=0xe0077a2c
|
||||
0x02236714 id=0x01 fn=0xe0077a5c
|
||||
0x0223671c id=0x02 fn=0xe007758c
|
||||
0x02236724 id=0x03 fn=0xe007747c
|
||||
0x0223672c id=0x04 fn=0xe0077aa2
|
||||
0x02236734 id=0x05 fn=0xe00776a8
|
||||
0x0223673c id=0x06 fn=0xe0077478
|
||||
0x02236744 id=0x07 fn=0xe00776b6
|
||||
# 92-entry {id,fn} array @ 0x02236bf0 (r5_t0_a02229800.bin)
|
||||
0x02236bf0 id=0x01 fn=0xe0083c88
|
||||
0x02236bf8 id=0x02 fn=0xe00844f2
|
||||
0x02236c00 id=0x03 fn=0xe00838c6
|
||||
0x02236c08 id=0x04 fn=0xe008453c
|
||||
0x02236c10 id=0x05 fn=0xe0083aa0
|
||||
0x02236c18 id=0x06 fn=0xe008461a
|
||||
0x02236c20 id=0x07 fn=0xe0083d1e
|
||||
0x02236c28 id=0x08 fn=0xe0084666
|
||||
0x02236c30 id=0x09 fn=0xe0083d62
|
||||
0x02236c38 id=0x0a fn=0xe00846b2
|
||||
0x02236c40 id=0x0b fn=0xe00838dc
|
||||
0x02236c48 id=0x0c fn=0xe0084586
|
||||
0x02236c50 id=0x0d fn=0xe00838f2
|
||||
0x02236c58 id=0x0e fn=0xe00845d0
|
||||
0x02236c60 id=0x0f fn=0xe0083908
|
||||
0x02236c68 id=0x10 fn=0xe00846fe
|
||||
0x02236c70 id=0x11 fn=0xe008391a
|
||||
0x02236c78 id=0x12 fn=0xe0084748
|
||||
0x02236c80 id=0x13 fn=0xe008392c
|
||||
0x02236c88 id=0x14 fn=0xe0084792
|
||||
0x02236c90 id=0x15 fn=0xe008393e
|
||||
0x02236c98 id=0x16 fn=0xe00847dc
|
||||
0x02236ca0 id=0x17 fn=0xe0083950
|
||||
0x02236ca8 id=0x18 fn=0xe0084826
|
||||
0x02236cb0 id=0x19 fn=0xe0083962
|
||||
0x02236cb8 id=0x1a fn=0xe008486e
|
||||
0x02236cc0 id=0x1b fn=0xe0083974
|
||||
0x02236cc8 id=0x1c fn=0xe00848b8
|
||||
0x02236cd0 id=0x1d fn=0xe0083986
|
||||
0x02236cd8 id=0x1e fn=0xe0084902
|
||||
0x02236ce0 id=0x1f fn=0xe0083998
|
||||
0x02236ce8 id=0x20 fn=0xe008494c
|
||||
0x02236cf0 id=0x21 fn=0xe00839aa
|
||||
0x02236cf8 id=0x22 fn=0xe0084996
|
||||
0x02236d00 id=0x23 fn=0xe00839c2
|
||||
0x02236d08 id=0x24 fn=0xe00849e2
|
||||
0x02236d10 id=0x25 fn=0xe00839da
|
||||
0x02236d18 id=0x26 fn=0xe0084a2e
|
||||
0x02236d20 id=0x27 fn=0xe00839f2
|
||||
0x02236d28 id=0x28 fn=0xe0084a7a
|
||||
0x02236d30 id=0x29 fn=0xe0083db0
|
||||
0x02236d38 id=0x2a fn=0xe0084ac6
|
||||
0x02236d40 id=0x2b fn=0xe0083d8e
|
||||
0x02236d48 id=0x2c fn=0xe0084b12
|
||||
0x02236d50 id=0x2d fn=0xe0083a20
|
||||
0x02236d58 id=0x2e fn=0xe0084b5e
|
||||
0x02236d60 id=0x31 fn=0xe0083a38
|
||||
0x02236d68 id=0x32 fn=0xe0084baa
|
||||
0x02236d70 id=0x33 fn=0xe0083a50
|
||||
0x02236d78 id=0x34 fn=0xe0084bf6
|
||||
0x02236d80 id=0x80 fn=0xe0083ddc
|
||||
0x02236d88 id=0x81 fn=0xe0084d06
|
||||
0x02236d90 id=0x82 fn=0xe0083ccc
|
||||
0x02236d98 id=0x83 fn=0xe0084c42
|
||||
0x02236da0 id=0x84 fn=0xe0084cae
|
||||
0x02236da8 id=0x85 fn=0xe008385c
|
||||
0x02236db0 id=0x86 fn=0xe0083884
|
||||
0x02236db8 id=0x87 fn=0xe0083b6a
|
||||
0x02236dc0 id=0x88 fn=0xe0083fc2
|
||||
0x02236dc8 id=0x89 fn=0xe0083cec
|
||||
0x02236dd0 id=0x8a fn=0xe0084d5a
|
||||
0x02236dd8 id=0xc0 fn=0xe0083b10
|
||||
0x02236de0 id=0xc1 fn=0xe00840cc
|
||||
0x02236de8 id=0xc2 fn=0xe0083b24
|
||||
0x02236df0 id=0xc3 fn=0xe0084112
|
||||
0x02236df8 id=0xc4 fn=0xe0083ba0
|
||||
0x02236e00 id=0xc5 fn=0xe00841a0
|
||||
0x02236e08 id=0xc6 fn=0xe0083bb4
|
||||
0x02236e10 id=0xc7 fn=0xe00841e6
|
||||
0x02236e18 id=0xc8 fn=0xe0083bc8
|
||||
0x02236e20 id=0xc9 fn=0xe008422c
|
||||
0x02236e28 id=0xca fn=0xe0083bdc
|
||||
0x02236e30 id=0xcb fn=0xe0084272
|
||||
0x02236e38 id=0xcc fn=0xe0083bf0
|
||||
0x02236e40 id=0xcd fn=0xe00842b8
|
||||
0x02236e48 id=0xce fn=0xe0083f4e
|
||||
0x02236e50 id=0xcf fn=0xe00842fe
|
||||
0x02236e58 id=0xd0 fn=0xe0083c1a
|
||||
0x02236e60 id=0xd1 fn=0xe0084394
|
||||
0x02236e68 id=0xd2 fn=0xe0083c04
|
||||
0x02236e70 id=0xd3 fn=0xe0083aec
|
||||
0x02236e78 id=0xd4 fn=0xe0084158
|
||||
0x02236e80 id=0xd5 fn=0xe0083c2e
|
||||
0x02236e88 id=0xd6 fn=0xe00843da
|
||||
0x02236e90 id=0xd7 fn=0xe0083c42
|
||||
0x02236e98 id=0xd8 fn=0xe0084420
|
||||
0x02236ea0 id=0xd9 fn=0xe0083c56
|
||||
0x02236ea8 id=0xda fn=0xe0084466
|
||||
0x02236eb0 id=0xdb fn=0xe00844ac
|
||||
0x02236eb8 id=0xdc fn=0xe0083c6a
|
||||
0x02236ec0 id=0xdd fn=0xe0084346
|
||||
0x02236ec8 id=0xea fn=0xe0083a6a
|
||||
# 10-entry {id,fn} array @ 0x0223833c (r5_t0_a02229800.bin)
|
||||
0x0223833c id=0x00 fn=0xe008f91e
|
||||
0x02238344 id=0x01 fn=0xe008f068
|
||||
0x0223834c id=0x02 fn=0xe008f080
|
||||
0x02238354 id=0x03 fn=0xe008f098
|
||||
0x0223835c id=0x04 fn=0xe008f18e
|
||||
0x02238364 id=0x05 fn=0xe008f1ba
|
||||
0x0223836c id=0x06 fn=0xe008f1d8
|
||||
0x02238374 id=0x07 fn=0xe008ee6c
|
||||
0x0223837c id=0x08 fn=0xe008f164
|
||||
0x02238384 id=0x0b fn=0xe008e3e0
|
||||
# 9-entry {id,fn} array @ 0x02238534 (r5_t0_a02229800.bin)
|
||||
0x02238534 id=0x00 fn=0xe0091a16
|
||||
0x0223853c id=0x01 fn=0xe0091a8c
|
||||
0x02238544 id=0x02 fn=0xe0091aec
|
||||
0x0223854c id=0x03 fn=0xe0091ee8
|
||||
0x02238554 id=0x04 fn=0xe009227c
|
||||
0x0223855c id=0x05 fn=0xe0091ba2
|
||||
0x02238564 id=0x00 fn=0xe00918f6
|
||||
0x0223856c id=0x01 fn=0xe00929b0
|
||||
0x02238574 id=0x02 fn=0xe0091c4e
|
||||
# 10-entry {id,fn} array @ 0x0223858c (r5_t0_a02229800.bin)
|
||||
0x0223858c id=0x07 fn=0xe0091cd8
|
||||
0x02238594 id=0x0a fn=0xe0079520
|
||||
0x0223859c id=0x0b fn=0xe0091d64
|
||||
0x022385a4 id=0x0c fn=0xe0091d96
|
||||
0x022385ac id=0x0d fn=0xe0091de0
|
||||
0x022385b4 id=0x0e fn=0xe0092690
|
||||
0x022385bc id=0x0f fn=0xe00924a0
|
||||
0x022385c4 id=0x10 fn=0xe0092568
|
||||
0x022385cc id=0x11 fn=0xe003f5d4
|
||||
0x022385d4 id=0x1b fn=0xe00925d4
|
||||
# 49-entry {id,fn} array @ 0x02238a5c (r5_t0_a02229800.bin)
|
||||
0x02238a5c id=0x00 fn=0xe00af53c
|
||||
0x02238a64 id=0x01 fn=0xe00af544
|
||||
0x02238a6c id=0x02 fn=0xe00af54c
|
||||
0x02238a74 id=0x03 fn=0xe00af554
|
||||
0x02238a7c id=0x00 fn=0xe00af578
|
||||
0x02238a84 id=0x01 fn=0xe00af55c
|
||||
0x02238a8c id=0x02 fn=0xe00af568
|
||||
0x02238a94 id=0x03 fn=0xe00af574
|
||||
0x02238a9c id=0x04 fn=0xe00af580
|
||||
0x02238aa4 id=0x05 fn=0xe00af58c
|
||||
0x02238aac id=0x06 fn=0xe00af598
|
||||
0x02238ab4 id=0x07 fn=0xe00af5a8
|
||||
0x02238abc id=0x11 fn=0xe00af5b8
|
||||
0x02238ac4 id=0x13 fn=0xe00af5c4
|
||||
0x02238acc id=0x16 fn=0xe00af5d0
|
||||
0x02238ad4 id=0x17 fn=0xe00af5e0
|
||||
0x02238adc id=0x00 fn=0xe00af5f0
|
||||
0x02238ae4 id=0x01 fn=0xe00af604
|
||||
0x02238aec id=0x02 fn=0xe00af61c
|
||||
0x02238af4 id=0x03 fn=0xe00af630
|
||||
0x02238afc id=0x04 fn=0xe00af644
|
||||
0x02238b04 id=0x05 fn=0xe00af658
|
||||
0x02238b0c id=0x06 fn=0xe00af670
|
||||
0x02238b14 id=0x07 fn=0xe00af604
|
||||
0x02238b1c id=0x08 fn=0xe00af5f0
|
||||
0x02238b24 id=0x09 fn=0xe00af670
|
||||
0x02238b2c id=0x0a fn=0xe00af604
|
||||
0x02238b34 id=0x0b fn=0xe00af604
|
||||
0x02238b3c id=0x00 fn=0xe00af684
|
||||
0x02238b44 id=0x01 fn=0xe00af690
|
||||
0x02238b4c id=0x02 fn=0xe00af69c
|
||||
0x02238b54 id=0x03 fn=0xe00af6b0
|
||||
0x02238b5c id=0x0d fn=0xe00af6b8
|
||||
0x02238b64 id=0x0e fn=0xe00af6c0
|
||||
0x02238b6c id=0x0f fn=0xe00af6c8
|
||||
0x02238b74 id=0x10 fn=0xe00af6d0
|
||||
0x02238b7c id=0x00 fn=0xe00af6d4
|
||||
0x02238b84 id=0x01 fn=0xe00a68d0
|
||||
0x02238b8c id=0x02 fn=0xe00af6d0
|
||||
0x02238b94 id=0x03 fn=0xe00af6e4
|
||||
0x02238b9c id=0x04 fn=0xe00a6988
|
||||
0x02238ba4 id=0x05 fn=0xe00af6e8
|
||||
0x02238bac id=0x06 fn=0xe00af6ec
|
||||
0x02238bb4 id=0x07 fn=0xe00af6fc
|
||||
0x02238bbc id=0x08 fn=0xe00af704
|
||||
0x02238bc4 id=0x09 fn=0xe00af714
|
||||
0x02238bcc id=0x0a fn=0xe00af71c
|
||||
0x02238bd4 id=0x0b fn=0xe00af728
|
||||
0x02238bdc id=0x0c fn=0xe00af734
|
||||
# 33-entry {id,fn} array @ 0x02238e44 (r5_t0_a02229800.bin)
|
||||
0x02238e44 id=0x00 fn=0xe003e66e
|
||||
0x02238e4c id=0x01 fn=0xe003e696
|
||||
0x02238e54 id=0x16 fn=0xe003c370
|
||||
0x02238e5c id=0x17 fn=0xe003c370
|
||||
0x02238e64 id=0x18 fn=0xe003c370
|
||||
0x02238e6c id=0x19 fn=0xe003c370
|
||||
0x02238e74 id=0x28 fn=0xe003c63e
|
||||
0x02238e7c id=0x2b fn=0xe003c63e
|
||||
0x02238e84 id=0x00 fn=0xe003c3aa
|
||||
0x02238e8c id=0x29 fn=0xe003c3ac
|
||||
0x02238e94 id=0x1a fn=0xe003c028
|
||||
0x02238e9c id=0x1b fn=0xe003c028
|
||||
0x02238ea4 id=0x1c fn=0xe003c028
|
||||
0x02238eac id=0x1d fn=0xe003c028
|
||||
0x02238eb4 id=0x12 fn=0xe003c34c
|
||||
0x02238ebc id=0x13 fn=0xe003c34c
|
||||
0x02238ec4 id=0x14 fn=0xe003c34c
|
||||
0x02238ecc id=0x15 fn=0xe003c34c
|
||||
0x02238ed4 id=0x06 fn=0xe003c012
|
||||
0x02238edc id=0x07 fn=0xe003c012
|
||||
0x02238ee4 id=0x08 fn=0xe003c012
|
||||
0x02238eec id=0x09 fn=0xe003c012
|
||||
0x02238ef4 id=0x0a fn=0xe003c012
|
||||
0x02238efc id=0x0b fn=0xe003c012
|
||||
0x02238f04 id=0x0c fn=0xe003c012
|
||||
0x02238f0c id=0x0d fn=0xe003c012
|
||||
0x02238f14 id=0x2e fn=0xe003e624
|
||||
0x02238f1c id=0x2f fn=0xe003e624
|
||||
0x02238f24 id=0x01 fn=0xe003e586
|
||||
0x02238f2c id=0x02 fn=0xe003e586
|
||||
0x02238f34 id=0x03 fn=0xe003e586
|
||||
0x02238f3c id=0x04 fn=0xe003e586
|
||||
0x02238f44 id=0x23 fn=0xe003c38c
|
||||
# 9-entry {id,fn} array @ 0x02238f74 (r5_t0_a02229800.bin)
|
||||
0x02238f74 id=0xef fn=0xe0041460
|
||||
0x02238f7c id=0xed fn=0xe00412e6
|
||||
0x02238f84 id=0x04 fn=0xe0040680
|
||||
0x02238f8c id=0x02 fn=0xe0042ebe
|
||||
0x02238f94 id=0x8d fn=0xe004276c
|
||||
0x02238f9c id=0x10 fn=0xe0043330
|
||||
0x02238fa4 id=0x4b fn=0xe00433fa
|
||||
0x02238fac id=0x7d fn=0xe004375c
|
||||
0x02238fb4 id=0xfc fn=0xe00437a4
|
||||
# 13-entry {id,fn} array @ 0x02238ffc (r5_t0_a02229800.bin)
|
||||
0x02238ffc id=0x06 fn=0xf009b6d6
|
||||
0x02239004 id=0x07 fn=0xf009b6d6
|
||||
0x0223900c id=0x08 fn=0xf009b6d6
|
||||
0x02239014 id=0x09 fn=0xf009b6d6
|
||||
0x0223901c id=0x0a fn=0xf009b6d6
|
||||
0x02239024 id=0x0b fn=0xf009b6d6
|
||||
0x0223902c id=0x0c fn=0xf009b6d6
|
||||
0x02239034 id=0x0d fn=0xf009b6d6
|
||||
0x0223903c id=0x0e fn=0xf009b6d6
|
||||
0x02239044 id=0x0f fn=0xf009b6d6
|
||||
0x0223904c id=0x10 fn=0xe006946e
|
||||
0x02239054 id=0x11 fn=0xe003d7b4
|
||||
0x0223905c id=0x12 fn=0xe00471f6
|
||||
|
|
@ -154,18 +154,39 @@ Next: same scan on WM; handler-by-handler decompile + naming pass.
|
|||
Ghidra project `wm`: forced disassembly to **555,385 instructions / 4,422
|
||||
functions** (import-time analysis alone: 226K/4,355).
|
||||
|
||||
- Code model differs from patch/WA: only **27 GP-relative references** in
|
||||
the whole image → WM uses (near-)absolute global addressing, so GP-base
|
||||
inference is not the unlock it would otherwise be.
|
||||
- Structural dispatch scan (scan_tables.py) across every region pairing
|
||||
found **no absolute function-pointer table** (unlike WA's 65-entry
|
||||
table, F7). WM command dispatch must use another mechanism —
|
||||
FP/register-relative tables, switch jump tables, or runtime handler
|
||||
registration (unknown U4).
|
||||
- ~~Code model claim: "only 27 GP-relative refs"~~ CORRECTED in F9: WM is
|
||||
GP-relative; the operand-object scan undercounted (missed memory-operand
|
||||
forms). GP value still unsolved, but the dispatcher's GP-relative
|
||||
constants identified the registration array structurally.
|
||||
- Structural scan found no *absolute-pointer* dispatch table — resolved in
|
||||
F9: dispatch is a runtime registration list, and the static registration
|
||||
arrays use GP-reachable data in region r5.
|
||||
- Regions: code 0xe003b000 (398KB) + 0xe009c400 (473KB mixed);
|
||||
data 0x0231dc00 (205KB), 0x0041xxxx pair; 0xf0xxxxxx block (feat 0x80)
|
||||
still uncharacterized (U1).
|
||||
|
||||
## F9 — WM dispatch solved: runtime registration list (2026-08-20, U4 resolved)
|
||||
|
||||
WM's command parser found via string xref (`EXT_CMD_ID:0x%02x, SEQ:%u...`
|
||||
@0xe00a64b0 → **FUN_0xe00412e6**): walks a handler registration array
|
||||
`{u8 cmd_id; code* handler}` (stride 8) at `gp+0x1b6a0`, count at
|
||||
`gp+0x227bc`; match → `handler(msg)`; miss → `Not_handled_ucExtenCID`.
|
||||
A top-level class array (r5 @0x02238f74) maps class 0xed → this parser.
|
||||
|
||||
Region r5 (0x02229800) holds the *static* registration arrays:
|
||||
**15 arrays / 407 `{id,fn}` entries** (`tools/scan_registrations.py` →
|
||||
`dataset/wm_registrations.txt`). Enum join names **130 handlers** from
|
||||
mt76's ABI (`dataset/wm_handlers_named.txt`) — e.g. 0x08
|
||||
CHANNEL_SWITCH→0xe003ff5c, 0x25 STA_REC_UPDATE, 0x32 WTBL→0xe00402fa,
|
||||
0x81 SER_TRIGGER→0xe005d480, 0x94 TWT→0xe0040de4, 0x9f
|
||||
MURU_CTRL→0xe0045f3c; 277 entries carry MTK-internal ids beyond the public
|
||||
enum (discovery list).
|
||||
|
||||
Labels applied (`LabelHandlers.py`): WM **371 functions** (115 created +
|
||||
256 renamed), WA **29** (from F7's table). r5 additionally carries 192
|
||||
function-name strings (`wsysWfdmaCmdHandle`, `muruExtCmdSetMuruStatistic`,
|
||||
...) — `__FUNCTION__`-style assert anchors for the next naming pass.
|
||||
|
||||
## Unknowns registry
|
||||
|
||||
- **U1 — `feature_set` bit 7 (0x80):** observed only on WM regions at
|
||||
|
|
@ -177,11 +198,9 @@ functions** (import-time analysis alone: 226K/4,355).
|
|||
bytes before/around the string (F2) are uninterpreted.
|
||||
- **U3 — WO container:** `mt7981_wo.bin` uses the mtk_wed loader
|
||||
(`mtk_wed_mcu.c`), a different format; not yet parsed.
|
||||
- **U4 — WM command dispatch mechanism:** no absolute-pointer handler
|
||||
table exists in any WM region (structural scan, F8); GP usage negligible.
|
||||
Candidate mechanisms: FP-relative tables, switch jump tables, runtime
|
||||
registration. Next lever: locate WM's command-receive loop via
|
||||
CCIF/mailbox strings and read its dispatch expression.
|
||||
- **U4 — WM command dispatch mechanism: RESOLVED (F9)** — runtime
|
||||
registration list at gp+0x1b6a0; static arrays in region r5; parser
|
||||
0xe00412e6.
|
||||
|
||||
## Related verified facts
|
||||
|
||||
|
|
|
|||
46
tools/ghidra_scripts/LabelHandlers.py
Normal file
46
tools/ghidra_scripts/LabelHandlers.py
Normal file
|
|
@ -0,0 +1,46 @@
|
|||
# Headless post-script: label command handlers from a named-handler map.
|
||||
# Reads files listed in env MTK_HANDLER_MAPS (colon-separated), lines like:
|
||||
# 0x02231eb0 id=0x25 fn=0xf0097174 MCU_EXT_CMD_STA_REC_UPDATE
|
||||
# Creates a function at each fn address (if missing) and renames it
|
||||
# cmdHdlr_<id02x>_<ENUMNAME>.
|
||||
#@category Analysis
|
||||
|
||||
import os
|
||||
import re
|
||||
from ghidra.program.model.symbol import SourceType
|
||||
from ghidra.app.cmd.function import CreateFunctionCmd
|
||||
from ghidra.app.cmd.label import RenameLabelCmd
|
||||
|
||||
maps = os.environ.get('MTK_HANDLER_MAPS', '')
|
||||
fm = currentProgram.getFunctionManager()
|
||||
created = renamed = skipped = 0
|
||||
pat = re.compile(r'id=(0x[0-9a-f]+) fn=(0x[0-9a-f]+) (MCU_[A-Z0-9_]+|\(MTK-internal id\))')
|
||||
|
||||
for path in maps.split(':'):
|
||||
if not path:
|
||||
continue
|
||||
print('map file: %s' % path)
|
||||
for ln in open(path):
|
||||
m = pat.search(ln)
|
||||
if not m:
|
||||
continue
|
||||
cid, fns, nm = int(m.group(1), 16), m.group(2), m.group(3)
|
||||
name = 'cmdHdlr_%02x_%s' % (cid, nm.strip('()').replace('-internal id', 'internal'))
|
||||
addr = currentProgram.getAddressFactory().getAddress(fns)
|
||||
f = fm.getFunctionAt(addr)
|
||||
tx = currentProgram.startTransaction('label')
|
||||
try:
|
||||
if f is None:
|
||||
f = createFunction(addr, name)
|
||||
if f is not None:
|
||||
created += 1
|
||||
else:
|
||||
skipped += 1
|
||||
print(' ! could not create %s at %s' % (name, fns))
|
||||
else:
|
||||
f.setName(name, SourceType.USER_DEFINED)
|
||||
renamed += 1
|
||||
print(' %s -> %s' % (fns, name))
|
||||
finally:
|
||||
currentProgram.endTransaction(tx, True)
|
||||
print('label summary: created=%d renamed=%d skipped=%d' % (created, renamed, skipped))
|
||||
53
tools/scan_registrations.py
Executable file
53
tools/scan_registrations.py
Executable file
|
|
@ -0,0 +1,53 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Scan MediaTek Connac2 firmware regions for {id, fn*} registration arrays.
|
||||
|
||||
WM registers command handlers as sparse {u8 cmd_id, code*} arrays (see
|
||||
findings F9: dispatcher walks gp+0x1b6a0, stride 8). This tool finds every
|
||||
such array across a blob's regions — the recoverable handler map.
|
||||
|
||||
Usage: scan_registrations.py <blob-stem-dir> [min_run] > out.txt
|
||||
(blob-stem-dir = extracted/mt7981_wm; scans all rN region files)
|
||||
"""
|
||||
import struct
|
||||
import sys
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
def code_p(w, ranges):
|
||||
return any(lo <= w < hi for lo, hi in ranges)
|
||||
|
||||
|
||||
def scan(f: Path, ranges, min_run):
|
||||
d = f.read_bytes()
|
||||
base = int(f.name.split('_a')[1][:8], 16)
|
||||
n = len(d) // 4
|
||||
ws = struct.unpack_from('<%dI' % n, d)
|
||||
out = []
|
||||
i = 0
|
||||
while i < n - 1:
|
||||
j, run = i, 0
|
||||
while j < n - 1 and ws[j] < 0x100 and code_p(ws[j + 1], ranges):
|
||||
run += 1
|
||||
j += 2
|
||||
if run >= min_run:
|
||||
out.append((base + i * 4, run, ws[i:j]))
|
||||
i = j + 2 if run else i + 1
|
||||
return out
|
||||
|
||||
|
||||
def main():
|
||||
stem = Path(sys.argv[1])
|
||||
min_run = int(sys.argv[2]) if len(sys.argv) > 2 else 8
|
||||
ranges = []
|
||||
for f in sorted(stem.glob('r*.bin')):
|
||||
base = int(f.name.split('_a')[1][:8], 16)
|
||||
ranges.append((base, base + f.stat().st_size))
|
||||
for f in sorted(stem.glob('r*.bin')):
|
||||
for addr, run, ws in scan(f, ranges, min_run):
|
||||
print('# %d-entry {id,fn} array @ 0x%08x (%s)' % (run, addr, f.name))
|
||||
for k in range(run):
|
||||
print('0x%08x id=0x%02x fn=0x%08x' % (addr + k * 8, ws[2 * k], ws[2 * k + 1]))
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
Loading…
Reference in a new issue