VOGONS


486DLC internal cache and Speedsys

Topic actions

Reply 20 of 41, by BitWrangler

User metadata
Rank l33t++
Rank
l33t++

I am a hamfisted meddler when it comes to such things, but I thought there would usually be some clue in the form of a text string in the first few lines of the file in a hex viewer that would give you a clue what it was packed with.

Unicorn herding operations are proceeding, but all the totes of hens teeth and barrels of rocking horse poop give them plenty of hiding spots.

Reply 21 of 41, by RayeR

User metadata
Rank Oldbie
Rank
Oldbie

Sure, I already looked through with hexaedit but didn't see anything obvious. Sometimes the signature of exe packer is intentionaly removed to obfuscate. I would't wonder if he used his own algo. BTW NSSI also use some kind of exe encryption/pack & protection against modification. I didn't googled any attempt to modify Speedsys. I found old homesite on webarchive and mailed the author but there's very little chance he respond after so many years, just a try...

Gigabyte GA-P67-DS3-B3, Core i7-2600K @4,5GHz, 8GB DDR3, 128GB SSD, GTX970(GF7900GT), SB Audigy + YMF724F + DreamBlaster combo + LPC2ISA

Reply 22 of 41, by BitWrangler

User metadata
Rank l33t++
Rank
l33t++

Probably a longshot, but once in a while WinRAR can detect what packed an exe and unpack it.

Edit: BTW, speedsys came to be made just a bit after the classic DOS era IIRC, so it might not be a "classic" one, but "something clever" that came along later.

Unicorn herding operations are proceeding, but all the totes of hens teeth and barrels of rocking horse poop give them plenty of hiding spots.

Reply 23 of 41, by RayeR

User metadata
Rank Oldbie
Rank
Oldbie

I tried with 7zip but no way. The file is very entropic, if packed the compression ratio is near to 100% so it confirms it's already packed or encrypted. My mail was returned from ***email.ru so no idea how else contact him. Who knows he's still alive (the war in russia /UA...).

I'll try with debugxv by Japheth, the latest version has capability to set breakpoint at specified I/O port address so maybe I could try to skip it. BTW on my Core i7-2600K Speedsys also hangs but during reading MSRs. It's similar issue. I guess he tries to read non-existing MSR in my CPU (because basic CPUID match some PIII family but he probably don't check extended CPUID) and it falls in some exception...

Gigabyte GA-P67-DS3-B3, Core i7-2600K @4,5GHz, 8GB DDR3, 128GB SSD, GTX970(GF7900GT), SB Audigy + YMF724F + DreamBlaster combo + LPC2ISA

Reply 24 of 41, by RayeR

User metadata
Rank Oldbie
Rank
Oldbie

Damn, I'm screwed. Tx486DLC doesn't have CR4 neither debug extension, it has only DR0-7 so I can't set breakpoint on IO access 🙁

I also search and look for some datasheets and it seems there's no difference in CPU config regs range CO-CFh but who knows what else Speedsys is trying to read. I hoped I'll see it in debugger but I can't...

Cx486DLC: However, each I/O port 23h operation must be preceded by an I/O port 22h operation, otherwise the second and later I/O port 23h operations are directed off-chip and produce external I/O bus cycles. Accesses to I/O port 22h with an index outside of the CO-CFh range also result in external I/O cycles and do not affect the on-chip configuration registers.

TI486DLC: Each I/O port 23h data transfer must be preceded by an I/O port 22h register selection, otherwise the second and later I/O port 23h operations are directed off-chip and produce external I/O cycles. If the register index number is outside the COh-CFh range, external I/O cycles will also occur.

Gigabyte GA-P67-DS3-B3, Core i7-2600K @4,5GHz, 8GB DDR3, 128GB SSD, GTX970(GF7900GT), SB Audigy + YMF724F + DreamBlaster combo + LPC2ISA

Reply 25 of 41, by RayeR

User metadata
Rank Oldbie
Rank
Oldbie

Yeah, I traced it via DarkDebugger (need stepping, breakpoint at I/O didn't work).
You can see that Speedsys attempts to read config reg. FEh from port 22/23h that is not valid for this CPU so it's passed to bus cycle and crashed the chipset. When I skipped this I/O operation Speedsys started and performed CPU benchmarg - I got ~11 points.but as it run limited in v86 mode it didn't do mem/cache tests.
Now I would need to find a way how to patch it at runtime or how to block I/O access to port 22h as I'm unable to patch existing EXE...

Gigabyte GA-P67-DS3-B3, Core i7-2600K @4,5GHz, 8GB DDR3, 128GB SSD, GTX970(GF7900GT), SB Audigy + YMF724F + DreamBlaster combo + LPC2ISA

Reply 26 of 41, by douglar

User metadata
Rank l33t
Rank
l33t

Nice work. This is fun stuff to read.

Reply 27 of 41, by RayeR

User metadata
Rank Oldbie
Rank
Oldbie

Meanwhile it happened that one guy on other forum, seeing by dbg effort, has just uplodad sources of Speedsys 4.79 WIP on Github under GPL (as author permitted), huh! He got it a long time ago from Vladimir when his mail worked yet. But no changes was made for the whole time, waiting for now. Sources seems to be pure asm work. I just need to grab some newer TASM to recompile. I already located the problematic routine doing invalid I/O on cyrix. A hotfix would be easy but I'd like to do it properly. Question is if I can reliable recognize 486DLC/SL* from other Cyrix via some regs/cpuid to branch the code that way it will not have any side effect on other CPUs...

Gigabyte GA-P67-DS3-B3, Core i7-2600K @4,5GHz, 8GB DDR3, 128GB SSD, GTX970(GF7900GT), SB Audigy + YMF724F + DreamBlaster combo + LPC2ISA

Reply 28 of 41, by mkarcher

User metadata
Rank l33t
Rank
l33t
RayeR wrote on 2025-04-13, 12:10:

Sources seems to be pure asm work.

That's surprising. Maybe a lot of assembler is included, but if I remember correctly, last time I debugged speedsys, it looked a lot like the main executable is Turbo Pascal compiled code (before packing). Do you have a link to the GitHub repository? Google doesn't seem to find it yet.

Reply 29 of 41, by RayeR

User metadata
Rank Oldbie
Rank
Oldbie

Here https://github.com/bttrx/speedsys
no *.pas there, build batch calls TASM.

Gigabyte GA-P67-DS3-B3, Core i7-2600K @4,5GHz, 8GB DDR3, 128GB SSD, GTX970(GF7900GT), SB Audigy + YMF724F + DreamBlaster combo + LPC2ISA

Reply 31 of 41, by RayeR

User metadata
Rank Oldbie
Rank
Oldbie

Btw the source was given by Vladimir in 2006 but it stucked in private closet 19 years, without any change...

Gigabyte GA-P67-DS3-B3, Core i7-2600K @4,5GHz, 8GB DDR3, 128GB SSD, GTX970(GF7900GT), SB Audigy + YMF724F + DreamBlaster combo + LPC2ISA

Reply 32 of 41, by douglar

User metadata
Rank l33t
Rank
l33t

Thanks for finding this. I need to build a QR feature that lets people post results to a website.

Reply 33 of 41, by RayeR

User metadata
Rank Oldbie
Rank
Oldbie

Here's the hotfix for 486DLC/SLC, so I finally got it benchmarked 😀

Gigabyte GA-P67-DS3-B3, Core i7-2600K @4,5GHz, 8GB DDR3, 128GB SSD, GTX970(GF7900GT), SB Audigy + YMF724F + DreamBlaster combo + LPC2ISA

Reply 34 of 41, by douglar

User metadata
Rank l33t
Rank
l33t
RayeR wrote on 2025-04-14, 00:26:

Here's the hotfix for 486DLC/SLC, so I finally got it benchmarked 😀

Lovely!

Would the screenshots be more usable for you if they were exported in GIF format?

Reply 35 of 41, by RayeR

User metadata
Rank Oldbie
Rank
Oldbie

If someone would like to programm a GIF encoding module in assembler it could be used instead of PCX. I think that PCX is much simpler format (using RLE compression?) than GIF. I think it's not necessary, everybody can use some external utility to convert PCX to any other bitmap format...

Gigabyte GA-P67-DS3-B3, Core i7-2600K @4,5GHz, 8GB DDR3, 128GB SSD, GTX970(GF7900GT), SB Audigy + YMF724F + DreamBlaster combo + LPC2ISA

Reply 36 of 41, by Marco

User metadata
Rank Oldbie
Rank
Oldbie

Wow thanks. Just discovered some issue with my new tx486sxlc2 and then just today the hotfix. Wow. Thanks !!!

1) VLSI SCAMP 311 | 386SX25@TI486SXLC2-50@60 | 16MB | CL-GD5428 | CT2830| SCC-1 | MT32 | Fast-SCSI AHA 1542CF + BlueSCSI v2/15k U320
2) SIS486 | 486DX/2 66(@80) | 32MB | TGUI9440 | LAPC-I

Reply 37 of 41, by keropi

User metadata
Rank l33t++
Rank
l33t++
RayeR wrote on 2025-04-14, 00:26:

Here's the hotfix for 486DLC/SLC, so I finally got it benchmarked 😀

thanks for the patched version!
great work!
time to update it in my setups 😁

🎵 🎧 MK1869, PCMIDI MPU , OrpheusII , Action Rewind , Megacard and 🎶GoldLib soundcard website

Reply 38 of 41, by Tiido

User metadata
Rank l33t
Rank
l33t

That is very nice ~

I do wonder, how hard would it be to skip the memory testing without skipping the cache testing ?

T-04YBSC, a new YMF71x based sound card & Official VOGONS thread about it
Newly made 4MB 60ns 30pin SIMMs ~
mida sa loed ? nagunii aru ei saa 😜

Reply 39 of 41, by mkarcher

User metadata
Rank l33t
Rank
l33t
Tiido wrote on 2025-04-14, 19:17:

I do wonder, how hard would it be to skip the memory testing without skipping the cache testing ?

I don't think I understand what you mean. With SST478, as included in Phil's dosbench, if you press "space" while the extended memory is being tested, the "memory test" is skipped, but the throughput benchmarks, which shows the effect of the cache is still performed. Isn't that what you are asking for?