The hell of CPU debugging

Size: px

Start display at page:

Download "The hell of CPU debugging"

Howard Marsh
5 years ago
Views:

1 The hell of CPU debugging Static analysis of CPU execution logs Franck

2 Introduction Content shown live available here: Blog post on the subject:

3 Text Emulator debugging GameBoy introduction and debugging

4 GameBoy CPU (~z80) Opcodes: 8 bits Bus d adresses: 16 bits Registers: %pc, %sp, %a, %f, %bc, %de, %hl. 501 instructions. Source:

5 Problems of debugging A lot of behavioural bugs: hard to debug. Bug effects don t usually tell much about the actual problem. A lot of uninteresting code executed; sometimes bugs are hidden in plain sight. Statically reverse engineering ROMs is not that interesting when what you debug is dynamic ;) The minimum you add to your emulator to debug it, the better (ie. write a z80 debugger? write a logging call?)

6 GameBoy is not only a CPU Apart from interrupts, there is memory banking, io ports, joypad, timings You need all of them implemented to start launching games correctly. Good news: one of them failing can (and will most likely for some) affect the CPU.

7 Text Bracoujl (Jarbocul) Introduction to the concepts

8 Input CPU logs the instructions it executes step by step. Reading them by hand is hard: You get to read all iterations of loops, You need to keep track of the call stack, switch when an interrupt happens, When comparing two execution logs, doing it with diff is not a good solution. Bracoujl takes those logs and makes readable graphs out of them.

9 Demo

10 Algorithm idea

20 Understood behaviours Interrupts: z80 has a jump table; if code starts there, we are in an interrupt. Functions: call and rets are understood. Conditional branches: conditional instructions create yes (green) and no (red) links. Memory changes: for self-modifying code, memory banking and virtual memory. push + ret: Some code found in actual games use this. (Demo)

21 Other features Graph comparison: Take two logs of two emulators, and compare them easily. Disassembly: Bracoujl manages the disassembly, providing information directly, without any addition to your emulator.

22 Text Bomberman Introduction Looks good, though.

23 Demo

24 What do we have? Even if it s not CPU s fault, it is impacted a lot. OK KO We can compare with a working emulator. Introduction works afterwards, so not the GPU? 320,138 ins. 2,938,046 ins. 13 MB 118 MB +800%

25 What else? Reference emulator is doing weird things with V-Blank interrupts, which is not implemented in nebula. Comparing anyway raises a first difference in sub_0819.

26 Demo

27 Bracoujl was spot-on. After fixing the joypad, the introduction was launching correctly without problems. (Thanks colo!) It actually allowed us to play too! yay!

28 Text Kriby s crash Executing wrong opcodes????

29 Demo

30 GameBoy Memory Banking Without memory banking, only 32 KiB would be available for game ROM. Permits to address up to 125 different banks. (MBC1) Only 2 banks addressed at any given time: 0 and NNh.

35 Demo (back)

36 The story of a refactoring [op] [bit], [reg] [op] [bit], (%hl) Refactor in simple functions that only do op, and do memory/register manipulation in a macro. Use only one macro, that always writes in memory even for bit operation.

37 What happens when a ROM executes bit N, (%hl) With %hl within 2000h:3FFFh?

38 Macro reads the value at address within 2000h:3FFFh bit operation is done on this value, sets the flag and returns unmodified value. Macro writes back unmodified value. Side effect: ROM bank is switched, changing the code that is next executed.

39 Macro reads the value at address within 2000h:3FFFh bit operation is done on this value, sets the flag and returns unmodified value. Macro writes back unmodified value. Side effect: ROM bank is switched, changing the code that is next executed. WRONG

40 Thank you for your attention Blog article on the subject: Git repository: Franck

Dante Gonzales and Ian Doten

Dante Gonzales and Ian Doten Overview History Game Boy and Game Boy Color Specs CPU architectures Intel 8080 Zilog Z80 Sharp LR35902 Sharp LR35902 in depth Changes from the Z80 to the LR35902 Memory Cartridge