Digifusion FVRT100/145/150/200 Tweaking


All files and advice on this site are provided in good faith,
but you use them at your own risk.

Nothing provided here comes with any warranty or guarantee.

ST20 Disassembler and Patch Development Utility


st20dis is a command-line disassembler for the SGS-Thomson ST20 C2/C4 instruction set which includes additional functions to assist with development of patches to existing binaries. A manual page is available.


Planned Features

Comments are welcome - send them to af123@jeamland.org, post to the Digital Spy Digifusion Forum or PM af123 there. I'm interested in experiences with st20dis, problems you encountered, proposals for enhancements, etc.


Usage of st20dis is free of charge for private, educational and commercial use. No responsiblity is taken for any damage caused by using st20dis.

Commercial distribution of either the original or modified versions of st20dis or including st20dis into commercial products is only allowed if explicitly permitted by the original author.

Usage Examples

Each example is followed by an indication of what would be found in the output file.
Disassembling a firmware file
C:\>st20dis -o <output file> <firmware file>
00000000: 60 be                 sub_0:       ajw #-2
00000002: 23 46                              ldc #36
00000004: 21 fb                              ldpi 
Without addresses or hex
C:\>st20dis -b -o <output file> <firmware file>
sub_0:       ajw #-2
             ldc #36
With full opcode help
C:\>st20dis -b -A -o <output file> <firmware file>
sub_0:       ajw #-2          ; adjust workspace - Move workspace pointer
             ldc #36          ; load constant - A = n, B=A, C=B
             ldpi             ; Load pointer to instruction - A = next instruction + A
Focusing on a subroutine and testing a patch
One of the things that the noscenes patch for the DigiFusion software does is change the byte at location 0xa57b to 0x02 from 0xa2. Disassemble this subroutine:

C:\>st20dis -S a57b <firmware file>

0000a546: 60 be                 sub_a546:    ajw #-2
0000a548: 11                                 ldlp #1
0000a549: 73                                 ldl #3
Note that the subroutine actually starts at 0xa546. Look at the bytes around 0xa57b:

C:\>st20dis -s a57a -e +4 <firmware file>

0000a57a: 70                    loc_a57a:    ldl #0
0000a57b: a2                                 cj loc_a57e
0000a57c: 62 0f                              j loc_a55d
And try the patch:

C:\>st20dis -s a57a -e +4 -p a57b=2 <firmware file>

0000a57a: 70                    loc_a57a:    ldl #0
0000a57b: 02                                 j loc_a57e
0000a57c: 62 0f                              j loc_a55d
The conditional jump has been changed to an unconditional one.

Read the man page for full details.


Version 1.0.3 - released 03/08/2010

Microsoft Windows, Intel.
Sun Solaris 10, SPARC, 64-bit.
Sun Solaris 10 (or OpenSolaris), x86, 32/64-bit.
MacOSX Snow Leopard, Intel.
other platforms coming soon
Version 1.0.2 - released 22/04/2008

Microsoft Windows, Intel.
Sun Solaris 10, SPARC, 64-bit.
Sun OpenSolaris 11, Intel.
MacOSX Leopard, Intel.
Linux, Intel.

Version 1.0.1 - released 25/03/2008

Version 1.0.0 - released 09/03/2008

Version 0.0.2 - released 26/2/2008

Version 0.0.1 - released 22/2/2008