marfrit
06d3d0d726
- benchmark/ai_ghidra/SETUP.md documents the GhidrAssist 1.5.0 install at /opt/ghidra/Ghidra/Extensions/GhidrAssist/ on oppenheimer (CT131), with dirac endpoints (Hermes-2-Pro 8B @ :8080, Qwen-coder 1.5B @ :8081) already reachable + tested. Final enable+config is UI-only; two clicks on next Ghidra launch. - gdb_debug/harness.c extended with case 4 = train_phy_block running under a synthetic PHY at 0x40000000. Static MMIO shim satisfies polls 1-3; poll 4 needs dynamic state-machine (next session, via SIGBUS handler or ptrace) — documented in the README. Vendor tree investigation: Rockchip's own sdram_rk3588.c / sdram_rk3568.c are STUBS (return -1). No free function names from there. Path forward: mine the vendor kernel's rockchip_dmc.c (devfreq DDR scaling driver) for register-offset naming hints at runtime-call level. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
RE-tool benchmark — three functions from the RK3588 DDR blob
Three small, self-contained functions extracted from
rk3588_ddr_lp4_1848MHz_lp5_2112MHz_v1.19.bin, each with canonical
ground-truth semantics so you can judge decompiler output against a
known answer.
| dir | blob offset | size | ground truth |
|---|---|---|---|
01_memset/ |
0x0aac |
28 B / 7 insts | memset(void*, u8, size_t) byte-wise |
02_memcpy32/ |
0x1200 |
36 B / 9 insts | memcpy32(u32*, const u32*, size_t) word-aligned |
03_magic_memset/ |
0x0da4 |
40 B / 9 insts | if (*(u32*)0x1fe004 == 0x54410001) memset(0x1fe000, 0, 0x32c); |
Each subdir contains:
func.bin— raw little-endian AArch64 machine codefunc.s— objdump'd GNU asm, same absolute addresses as the blobreference.c— ground-truth C (our belief)ghidra.md— load-in-Ghidra recipe + expected outputdecompme.md— decomp.me scratch recipe (matching-decomp)retdec.md— retdec command lineretdec.c— retdec's actual output (captured 2026-04-15)
Summary of findings: see RESULTS.md. Short version:
- Ghidra got all three right with minor type-label cleanup needed.
- retdec failed on #1 and #2 (can't infer register-passed arguments on raw binary), did well on #3 (the one with absolute-address refs).
- decomp.me is a matching-decomp comparator, not a decompiler — judged on a different axis.
Load address matters
All three functions are extracted as raw bytes starting at offset 0 in
their func.bin. When loading into Ghidra / retdec, set the base
address to the function's original blob offset (first column above),
otherwise branch targets and absolute-address refs in function #3 will
be off.