though a9's real value is not set there, must be same as MED17 where a9 is a cal table pointer.
a0, a1, a8 register values successfully found. As regards a9 register, I found some topics about ME17 ECU`s with a9 register searching info. As far as I know in ME17 a9 register value should be set with one of another global registers value (+ offset). I`ve found some subroutines with a9 register occurrences, but I`m surely missing something.
...
ROM:800850F8 add16.a a9, a6
ROM:800850FA fret16
...
ROM:80086068 loc_80086068: ; DATA XREF: sub_800D47DC+CE↓r
ROM:80086068 ; sub_800FEF48+56↓r
ROM:80086068 sub16.a sp, #0x45 ; 'E'
ROM:8008606A nop16
ROM:8008606C mov16.a a9, d13
ROM:8008606E fret16
...
ROM:800943F8 loc_800943F8: ; DATA XREF: ROM:801F39C6↓o
ROM:800943F8 ; ROM:801F39CC↓o ...
ROM:800943F8 addsc16.a a15, a9, d15, #0
ROM:800943FA
...
ROM:8009A948 loc_8009A948: ; DATA XREF: sub_80231B72+C↓o
ROM:8009A948 ; sub_80231B72+1A↓o ...
ROM:8009A948 mov16 d0, d0
ROM:8009A94A nop16
ROM:8009A94C mov16.a a9, d13
ROM:8009A94E fret16
...
ROM:8009AFE0 mov16.a a9, #0xC
ROM:8009AFE2 fret16
You have to have at least some map addresses and/or variable addresses, or otherwise it will be very difficult to get anything out of this.
I have some map addresses, digged out from winOLS. Should I try to find out a9 value using map addresses and offsets?
