AVR analysis

[Zielony Lew]

Hello,

I've got a problem with program analysis. I have a HEX file that is used to
program an ATMEL chip AT90S2313.
I've used to AVR Studio to disassemble the HEX file to assembler, but it's
still to big to analyze for me..
Is there here somebody that can help me with this assignment?
I have to write a short (?) description of what the program is doing or to
draw a block schema (with loops or sth). But i think the second is undoable
without going through the whole code line by line and memory maps.. and I
can't do it :(
I know that the whole thing is being used in an accumulator charger...
I was also given a circuit connections schema..

The source of ASM can be viewed herE: http://warden.anim.pl/atmel/ASM.txt
and the circuit: Loading Image...
If the source HEX is needed then it's here:
http://warden.anim.pl/atmel/schg.hex

Please help.. i have to write it till wednesday :(


Thanks in advance for all your help!

[jim w]

Who is asking you to do this, and why?
- jim

Post by Zielony Lew
Hello,
I've got a problem with program analysis. I have a HEX file that is used to
program an ATMEL chip AT90S2313.
I've used to AVR Studio to disassemble the HEX file to assembler, but it's
still to big to analyze for me..
Is there here somebody that can help me with this assignment?
I have to write a short (?) description of what the program is doing or to
draw a block schema (with loops or sth). But i think the second is undoable
without going through the whole code line by line and memory maps.. and I
can't do it :(
I know that the whole thing is being used in an accumulator charger...
I was also given a circuit connections schema..
The source of ASM can be viewed herE: http://warden.anim.pl/atmel/ASM.txt
and the circuit: http://warden.anim.pl/atmel/schg.jpg
http://warden.anim.pl/atmel/schg.hex
Please help.. i have to write it till wednesday :(
Thanks in advance for all your help!

[Zielony Lew]

Post by jim w
Who is asking you to do this, and why?
- jim

unfortunately this is my 'homework'..
and the guy who was giving the lecture to us didn't explain how to do such
things.
he gave us this for kinda classword before the exam.
why are you asking? because it sounded like a top secret information..
can you help me somehow? or give some hints how to do it? cause i have no
clue how not to do it not line by line...
besides, i'm not so good in all the registers and hex things to know why it
is 0x7F or not :(
and now the whole group is counting somehow on me and maybe your help.

[jim w]

To be honest, I asked because I suspected this was a homework assignment...

Nothing personal.. but you really should give it a go.

I (and others on these newsgroups) will be glad to help.. but I(/we)
won't do the work for you.

First of all, do you have an AVR instruction set manual? If not, go to
www.atmel.com and get the pdf.


Next, start trying to identify subroutines, the first hint... Look for
calls... Calls will always point to the entry of a subroutine. Next,
start analyzing the jmp's. Jmp's generally point to blocks of code, like
loops, or around blocks of an control ( if(){} for example ), or two
exit blocks, etc etc etc.

This is not that hard.... Have you tried? Start working on it, and I'll
be glad to assist where I can.

I hope you don't think I'm being a prick... but this is the kind of
stuff you'll have to do once you get your degree, so you may as well
figure it out now.

Post by Zielony Lew

Post by jim w
Who is asking you to do this, and why?
- jim

unfortunately this is my 'homework'..
and the guy who was giving the lecture to us didn't explain how to do such
things.
he gave us this for kinda classword before the exam.
why are you asking? because it sounded like a top secret information..
can you help me somehow? or give some hints how to do it? cause i have no
clue how not to do it not line by line...
besides, i'm not so good in all the registers and hex things to know why it
is 0x7F or not :(
and now the whole group is counting somehow on me and maybe your help.

[Zielony Lew]

Post by jim w
Next, start trying to identify subroutines, the first hint... Look for
calls... Calls will always point to the entry of a subroutine. Next,
start analyzing the jmp's. Jmp's generally point to blocks of code, like
loops, or around blocks of an control ( if(){} for example ), or two
exit blocks, etc etc etc.

This I know.. After all i do like programming but not in asm..
Ok, i can write the code for some subroutines.. but..
how do i know for instance, why there is 0x7f loaded to R17 or sth like
that.
Or that sth will happen when the button (on the schema) is pressed...

Frankly, I've waited for the kind of help you have proposed... not doing it
for me :)
(i like to know what i'm doing)

[jim w]

You'll have to understand the AVR port programming to understand the
button press stuff
The AVR has data direction registers (DDRx where 'x' is A, B, C, D, E)
to control the direction of a port. Each bit in the DDRx corresponds to
a bit on the physical port.

Do you have the Atmel instruction set summary, and the AVR spec for the
processor in quesion?

"How do you know why 0x7F is loaded into R17"? If you were reading a
line of C code, or Java, or whatever, how would you know why any number
was loaded into any variable? By reading and understanding the intent of
the programmer.

First off, the disassembly you included doesn't start from addr 0x0000..
I disassembled it my self..... Is there some reason you only provided
the disassembly from add 0x221

Anyway... Take a look at the block of code below.. Can you tell us
what's going on here? (You'll need the instruction manual and the spec
for the 2313)

Take a shot at commenting this, and replying to the group with your
commented code.

- jim

+0000008C: 2788 CLR R24 Clear Register
+0000008D: 2799 CLR R25 Clear Register
+0000008E: EE0F LDI R16,0xEF Load immediate
+0000008F: 2EB0 MOV R11,R16 Copy register
+00000090: EF0F SER R16 Set Register
+00000091: BB02 OUT 0x12,R16 Out to I/O location
+00000092: BB01 OUT 0x11,R16 Out to I/O location
+00000093: E10F LDI R16,0x1F Load immediate
+00000094: BB07 OUT 0x17,R16 Out to I/O location
+00000095: EF07 LDI R16,0xF7 Load immediate
+00000096: BB08 OUT 0x18,R16 Out to I/O location
+00000097: E004 LDI R16,0x04 Load immediate
+00000098: BF03 OUT 0x33,R16 Out to I/O location
+00000099: E002 LDI R16,0x02 Load immediate
+0000009A: BF09 OUT 0x39,R16 Out to I/O location
+0000009B: E001 LDI R16,0x01 Load immediate
+0000009C: BD0E OUT 0x2E,R16 Out to I/O location
+0000009D: 9478 SEI Global Interrupt Enable
~

As an example... here's a bit of commenting of the code to read
sw1/sw2/sw3/sw4


Beginning of subroutine to check swith push
Set bit zero, portB
+00000042: 9AC0 SBI 0x18,0 Set bit in I/O register
+00000043: FF86 SBRS R24,6 Skip if bit in
register set
+00000044: C004 RJMP PC+0x0005 Relative jump
+00000045: 2D09 MOV R16,R9 Copy register
+00000046: 3007 CPI R16,0x07 Compare with immediate
+00000047: F138 BRCS PC+0x28 Branch if carry set
+00000048: 7B8F ANDI R24,0xBF Logical AND with immediate

Set DDRd to FC, i.e. input from D0/D1 bits
+00000049: EF0C LDI R16,0xFC Load immediate
+0000004A: BB01 OUT 0x11,R16 Out to I/O location


Port D pins to 1011 so that we can read switches 3/4
+0000004B: EF0B LDI R16,0xFB Load immediate
+0000004C: BB02 OUT 0x12,R16 Out to I/O location

delay loop
+0000004D: E005 LDI R16,0x05 Load immediate
+0000004E: 950A DEC R16 Decrement
+0000004F: F7F1 BRNE PC-0x01 Branch if not equal


Read PinD
+00000050: B300 IN R16,0x10 In from I/O location


Don't care about anything but pins 0/1
+00000051: 7003 ANDI R16,0x03 Logical AND with immediate

Move the "state" of Sw3/4 to the 3rd/4th bits... cute trick
+00000052: 0F00 LSL R16 Logical Shift Left
+00000053: 0F00 LSL R16 Logical Shift Left

Save the state of the switches
+00000054: 2F10 MOV R17,R16 Copy register

Now, set up so we can read switches 1/2
+00000055: EF07 LDI R16,0xF7 Load immediate
+00000056: BB02 OUT 0x12,R16 Out to I/O location

Again we delay for 5
+00000057: E005 LDI R16,0x05 Load immediate
+00000058: 950A DEC R16 Decrement
+00000059: F7F1 BRNE PC-0x01 Branch if not equal

Read PinD
+0000005A: B300 IN R16,0x10 In from I/O location

Mask off all but the bottom two bits
+0000005B: 7003 ANDI R16,0x03 Logical AND with immediate

Or this into the saved Sw3/4 data
+0000005C: 2B10 OR R17,R16 Logical OR

Are any of the 4 switches pressed?
+0000005D: 301F CPI R17,0x0F Compare with immediate
+0000005E: F421 BRNE PC+0x05 Branch if not equal


.... No switch pressed, so head to cleanup to
+0000005F: FF85 SBRS R24,5 Skip if bit in
register set
+00000060: C00E RJMP PC+0x000F Relative jump

Post by Zielony Lew
This I know.. After all i do like programming but not in asm..
Ok, i can write the code for some subroutines.. but..
how do i know for instance, why there is 0x7f loaded to R17 or sth like
that.
Or that sth will happen when the button (on the schema) is pressed...
Frankly, I've waited for the kind of help you have proposed... not doing it
for me :)
(i like to know what i'm doing)