[TripleBlackVert]

According to the documentation, the stack pointer is at address $0018, AKA REG_18. So the following code sets it to $0000. this is apparently all part of the initialization code.

Code: Select all

 2032 FA            61 L2032 di
 2033 FF            62       nop
 2034 110C          63       clrb  HSI_Data_Mask
 2036               64 ;* Save  REG$2A
 2036 B02A12        65       ldb   REG_12,REG_2A
 2039               66 ;* Clear locations from  $0016  through  $0489
 2039 A1160014      67       ld    REG_14,#$0016
 203D C61500        68 L203D stb   Zero,[REG_14]+
 2040 1704          69       incb  Watchdog_Timer
 2042 898A0414      70       cmp   REG_14,#$048A
 2046 D3F5          71       jnc   L203D

next comes this:

Code: Select all

 2091 EF0164       107       lcall L84B2                       ;???
 2094 EFEC64       108       lcall L85A3                       ;???
 2097 EF3B65       109       lcall L85F5                       ;???
 209A              110 ;***** ----
 209A A374DE42     111       ld    REG_42,$DE[REG_74]
 209E C3749E42     112       st    REG_42,$9E[REG_74]
...

so the return address ($2093) is stored at $FFFE/$FFFF.
before long, it goes through this code:

Code: Select all

 84D7 A1F00018    8762 L84F5 ld    REG_18,#$00F0
 84DB B3012020    8763       ldb   REG_1A,$2020[Zero]
 84DF 1A               
 84E0 A2151C      8764 L84FE ld    REG_1C,[REG_14]+
 84E3 C2191C      8765       st    REG_1C,[REG_18]+
 84E6 E0E01A      8766       djnz  REG_1A,L84FE

by the end of that loop, the stack pointer is $0100
then we get to this:

Code: Select all

 852F F0            ret

at this point, $0100 is $5BC0. so returning does not actually back to where one would logically expect it to (the instruction after the above lcall L84B2), instead, the program counter will jump to $5BC1. while i suppose that could be correct, i am suspicious of it, because there is what looks like valid code after the lcall to 84B2 which will never be executed

thoughts?

[decipha]

[sailorbob]

The stack pointer is at 0x0010 in the 8061 (it's at 0x0020 in the 8065 with an alternative stack pointer at 0x0022). It first gets initialised at 0x214B.

[TripleBlackVert]

perfect, thanks

[tvrfan]

Hi all, I've just joined the list - I spent a lot of time over the years on trying to understand the various binaries.....

the A9L writes to the stack pointer in several places, for interrupt handling, and also
for self test mode(s). whenever this is done, the code has several 'nop' ops after it.

It seems to be quite safe to mess with the pointer as long as di (disable ints) is set, and
no subroutine calls are made.

Andy.