romdevtools 0.43.0 → 0.56.1

package/src/analysis/analyze.js

@@ -12,7 +12,7 @@
 // resolved by the existing disasm mappers — analysis here is whole-file.
 import { readFile } from "node:fs/promises";
 import path from "node:path";
-import { runRizinJson, RIZIN_ARCH } from "./rizin.js";
+import { runRizinJson, RIZIN_ARCH, RIZIN_ENDIAN } from "./rizin.js";
 import { decompileFunction, SLEIGH_LANGID } from "./decompile.js";
 import { registersForPlatform } from "../platforms/common/registers.js";
 
@@ -133,13 +133,72 @@ export function sniffPlatform(p) {
   if (/\.(lnx|lyx)$/i.test(p)) return "lynx";
   if (/\.gba$/i.test(p)) return "gba";
   if (/\.pce$/i.test(p)) return "pce";
+  if (/\.(z64|n64|v64)$/i.test(p)) return "n64";
+  if (/\.(psexe|psx)$/i.test(p)) return "ps1"; // .exe/.bin ambiguous — pass platform explicitly
   if (/\.(gen|md|bin)$/i.test(p)) return "genesis";
   return null;
 }
 
 /** rizin asm.bits per arch (analysis defaults; rizin's loader usually sets
  * these for recognized formats, but raw blobs need a hint). */
-const BITS = { arm: 32, m68k: 32, snes: 16 };
+const BITS = { arm: 32, m68k: 32, snes: 16, mips: 32 };
+
+/**
+ * The rizin analysis-SEED command for a context. For the 8/16-bit platforms
+ * rizin's `aaa` recognizes the bin format / vectors and seeds itself. For a RAW
+ * MIPS image (N64/PS1) there's no recognized entry, so `aaa` finds nothing —
+ * instead define a function at the code start and recursively analyze its call
+ * graph (`af` + `aac`), which surfaces the real function tree (verified: 251
+ * functions on a real libdragon N64 ROM where `aaa` found 0).
+ * @param {{arch:string, codeStart:number}} ctx
+ * @returns {string} the seed command (no trailing semicolon)
+ */
+function analysisSeed({ arch, codeStart }) {
+  if (arch === "mips") {
+    const at = "0x" + (codeStart || 0).toString(16);
+    return `af @ ${at}; aac @ ${at}`;
+  }
+  return "aaa";
+}
+
+/** MIPS analysis runs FLAT (rizin ignores -B on a raw malloc:// buffer), so rizin
+ *  reports FILE-OFFSET addresses. For PS1 loadContext left-pads the .text so flat
+ *  offset == the VA's low 20 bits (see there); we add the VA's HIGH bits back as
+ *  `rebase` so callers get real VAs that round-trip through the decompile
+ *  VA→fileOffset math. N64 (.z64) keeps its absolute VAs baked into the code and is
+ *  analyzed flat from codeStart, so no rebase. */
+function mipsAnalysisBase({ arch, platform, loadBase, codeStart }) {
+  const rebase = (arch === "mips" && platform === "ps1" && loadBase) ? (loadBase & 0xfff00000) >>> 0 : 0;
+  return { baddr: undefined, seedAt: codeStart, rebase };
+}
+
+/**
+ * Normalize an N64 ROM to BIG-ENDIAN (.z64) byte order. Dumps come in three
+ * orders, distinguished by the first 4 bytes of the header:
+ *   .z64 (big)    80 37 12 40   — native; no change
+ *   .v64 (byteswap)37 80 40 12  — swap every 2 bytes
+ *   .n64 (little) 40 12 37 80   — swap every 4 bytes
+ * MIPS analysis wants the big-endian image so addresses + instruction words line up.
+ * @param {Uint8Array} bytes
+ * @returns {{ bytes: Uint8Array, reordered: string|null }}
+ */
+function normalizeN64ByteOrder(bytes) {
+  if (bytes.length < 4) return { bytes, reordered: null };
+  const b = bytes;
+  const is = (a, c, d, e) => b[0] === a && b[1] === c && b[2] === d && b[3] === e;
+  if (is(0x80, 0x37, 0x12, 0x40)) return { bytes, reordered: null }; // .z64 big — native
+  if (is(0x37, 0x80, 0x40, 0x12)) { // .v64 byteswapped — swap pairs
+    const out = new Uint8Array(b.length & ~1);
+    for (let i = 0; i + 1 < b.length; i += 2) { out[i] = b[i + 1]; out[i + 1] = b[i]; }
+    return { bytes: out, reordered: "v64 (byteswapped) → z64" };
+  }
+  if (is(0x40, 0x12, 0x37, 0x80)) { // .n64 little — swap dwords
+    const out = new Uint8Array(b.length & ~3);
+    for (let i = 0; i + 3 < b.length; i += 4) { out[i] = b[i + 3]; out[i + 1] = b[i + 2]; out[i + 2] = b[i + 1]; out[i + 3] = b[i]; }
+    return { bytes: out, reordered: "n64 (little-endian dwords) → z64" };
+  }
+  return { bytes, reordered: null }; // unknown header — leave as-is
+}
 
 /** Build the common rizin invocation context for a ROM + platform. Returns
  * { romBytes, arch, bits, note } — arch null means let rizin sniff. */
@@ -175,11 +234,53 @@ async function loadContext(romPath, platformOverride) {
     loadBase = romBytes[0] | (romBytes[1] << 8);
     romBytes = romBytes.subarray(2);
   }
+  const warningsEarly = [];
+  // N64: normalize to big-endian (.z64) byte order, then the ROM header's entry
+  // point (big-endian word at 0x08) is the CPU load base. The 0x1000-byte header
+  // (IPL3 bootcode) precedes the game; rizin analyzes the whole image but the
+  // entry tells functions where code starts.
+  let codeStart = 0; // file offset where executable code begins (post-header)
+  if (platform === "n64") {
+    const norm = normalizeN64ByteOrder(romBytes);
+    romBytes = norm.bytes;
+    if (norm.reordered) warningsEarly.push(`N64 ROM was ${norm.reordered} byte order — normalized to z64 (big-endian) for analysis.`);
+    if (romBytes.length >= 0x0c) {
+      // entry point: big-endian 32-bit at offset 0x08.
+      loadBase = (romBytes[0x08] << 24) | (romBytes[0x09] << 16) | (romBytes[0x0a] << 8) | romBytes[0x0b];
+    }
+    // The IPL3 bootcode occupies the first 0x1000 bytes; game code starts after it.
+    // rizin's `aaa` doesn't recognize a raw N64 ROM's entry, so analysis is seeded
+    // here (see ANALYSIS_SEED).
+    codeStart = 0x1000;
+  }
+  // PS1 PS-EXE: a 2048-byte header; the load (t_addr) is a little-endian word at
+  // 0x18, and the code follows the header. Strip the header so rizin sees code at
+  // the load address. A raw .bin (no PS-EXE magic) is left flat.
+  if (platform === "ps1" && romBytes.length >= 0x800 &&
+      romBytes[0] === 0x50 && romBytes[1] === 0x53 && romBytes[2] === 0x2d && romBytes[3] === 0x58) { // "PS-X"
+    loadBase = (romBytes[0x18] | (romBytes[0x19] << 8) | (romBytes[0x1a] << 16) | (romBytes[0x1b] << 24)) >>> 0;
+    const text = romBytes.subarray(0x800);
+    // rizin ignores -B on a raw malloc:// buffer, so it addresses flat from 0. PS1
+    // jal targets are ABSOLUTE VAs (e.g. jal 0x80010518) — to let rizin follow them,
+    // left-pad the .text by the load address's low 20 bits so flat offset N == the
+    // VA's low bits (jal masks to a 28-bit region). The high bits (0x80000000) are
+    // added back as `rebase`. Without this, every cross-function call dangles and
+    // only the entry blob is discovered. (Cap the pad so a weird t_addr can't OOM.)
+    const lowPad = loadBase & 0x000fffff;
+    if (lowPad > 0 && lowPad <= 0x200000) {
+      const padded = new Uint8Array(lowPad + text.length);
+      padded.set(text, lowPad);
+      romBytes = padded;
+      codeStart = lowPad;
+    } else {
+      romBytes = text;
+    }
+  }
 
   // A6: container/format sniff. Some dumps are interleaved/headered such that a
   // FLAT read scrambles every byte → fake "bad instruction" noise everywhere.
   // Detect + auto-correct, and warn so a flat disasm isn't silently wrong.
-  const warnings = [];
+  const warnings = [...warningsEarly];
   if (platform === "genesis") {
     const smd = deinterleaveSmd(romBytes);
     if (smd) {
@@ -188,7 +289,7 @@ async function loadContext(romPath, platformOverride) {
         "auto-deinterleaved before analysis. A flat read of the original would scramble every instruction.");
     }
   }
-  return { platform, romBytes, arch, bits: BITS[arch], approx, loadBase, warnings };
+  return { platform, romBytes, arch, bits: BITS[arch], endian: RIZIN_ENDIAN[platform], approx, loadBase, codeStart, warnings };
 }
 
 /** Detect + reverse Sega Mega Drive SMD interleaving. An .smd dump is a 512-byte
@@ -227,11 +328,12 @@ function hx(n) { return "0x" + (n >>> 0).toString(16); }
  * @returns {{platform, count, functions: Array<{address, name, size, nbbs, cc, callers, callees}>}}
  */
 export async function analyzeFunctions(romPath, platformOverride) {
-  const { platform, romBytes, arch, bits, loadBase, warnings } = await loadContext(romPath, platformOverride);
-  const fns = await runRizinJson({ romBytes, arch, bits, baddr: loadBase || undefined, commands: "aaa; aflj" });
+  const { platform, romBytes, arch, bits, endian, loadBase, codeStart, warnings } = await loadContext(romPath, platformOverride);
+  const { baddr, seedAt, rebase } = mipsAnalysisBase({ arch, platform, loadBase, codeStart });
+  const fns = await runRizinJson({ romBytes, arch, bits, endian, baddr, commands: `${analysisSeed({ arch, codeStart: seedAt })}; aflj` });
   const functions = fns.map((f) => ({
-    address: f.offset,
-    addressHex: hx(f.offset),
+    address: (f.offset + rebase) >>> 0,
+    addressHex: hx((f.offset + rebase) >>> 0),
     name: f.name,
     size: f.size,
     nbbs: f.nbbs,           // basic-block count
@@ -269,30 +371,35 @@ export async function analyzeFunctions(romPath, platformOverride) {
  */
 export async function analyzeCfg(romPath, address, platformOverride) {
   if (address == null) throw new Error("analyze cfg: address required");
-  const { platform, romBytes, arch, bits, loadBase } = await loadContext(romPath, platformOverride);
+  const { platform, romBytes, arch, bits, endian, loadBase, codeStart } = await loadContext(romPath, platformOverride);
   // afbj = basic blocks of the function as JSON: each block has addr/size/jump/
   // fail/ninstr. `jump` is the taken edge; `fail` (present only on conditional
   // blocks) is the fall-through. This is the structured CFG source — `agf json`
   // only gives a text body blob with untyped out_nodes.
+  // MIPS: seed the call graph first (the address is a vaddr from `functions`,
+  // which rizin recovers during `aac`). PS1 rebases to loadBase so the vaddr lines up.
+  const { baddr, seedAt, rebase } = mipsAnalysisBase({ arch, platform, loadBase, codeStart });
+  const flat = ((address >>> 0) - rebase) >>> 0; // VA → flat offset rizin uses
+  const rb = (a) => (a == null ? a : (a + rebase) >>> 0);
   const blocks = await runRizinJson({
-    romBytes, arch, bits, baddr: loadBase || undefined,
-    commands: `aaa; af @ ${hx(address)}; afbj @ ${hx(address)}`,
+    romBytes, arch, bits, endian, baddr,
+    commands: `${analysisSeed({ arch, codeStart: seedAt })}; af @ ${hx(flat)}; afbj @ ${hx(flat)}`,
   });
   if (!Array.isArray(blocks) || blocks.length === 0) {
     return { platform, arch, address, addressHex: hx(address), nodes: [], edges: [], note: "no function/blocks at address" };
   }
   const nodes = blocks.map((b) => ({
-    id: b.addr,
-    address: b.addr,
-    addressHex: hx(b.addr),
+    id: rb(b.addr),
+    address: rb(b.addr),
+    addressHex: hx(rb(b.addr)),
     size: b.size,
     ninstr: b.ninstr,
   }));
   const edges = [];
   for (const b of blocks) {
     const conditional = b.fail != null;
-    if (b.jump != null) edges.push({ from: b.addr, to: b.jump, type: conditional ? "branch_true" : "jump_or_fall" });
-    if (b.fail != null) edges.push({ from: b.addr, to: b.fail, type: "branch_false" });
+    if (b.jump != null) edges.push({ from: rb(b.addr), to: rb(b.jump), type: conditional ? "branch_true" : "jump_or_fall" });
+    if (b.fail != null) edges.push({ from: rb(b.addr), to: rb(b.fail), type: "branch_false" });
   }
   return {
     platform, arch,
@@ -308,10 +415,13 @@ export async function analyzeCfg(romPath, address, platformOverride) {
  */
 export async function analyzeXrefs(romPath, address, platformOverride) {
   if (address == null) throw new Error("analyze xrefs: address required");
-  const { platform, romBytes, arch, bits, loadBase } = await loadContext(romPath, platformOverride);
+  const { platform, romBytes, arch, bits, endian, loadBase, codeStart } = await loadContext(romPath, platformOverride);
+  const { baddr, seedAt, rebase } = mipsAnalysisBase({ arch, platform, loadBase, codeStart });
+  const flat = ((address >>> 0) - rebase) >>> 0;
+  const rb = (a) => (a == null ? a : (a + rebase) >>> 0);
   let refs;
   try {
-    refs = await runRizinJson({ romBytes, arch, bits, baddr: loadBase || undefined, commands: `aaa; axtj @ ${hx(address)}` });
+    refs = await runRizinJson({ romBytes, arch, bits, endian, baddr, commands: `${analysisSeed({ arch, codeStart: seedAt })}; axtj @ ${hx(flat)}` });
   } catch (e) {
     // axtj prints nothing (not even `[]`) when there are zero refs → our JSON
     // guard throws. Treat "no JSON" as "no refs".
@@ -319,9 +429,9 @@ export async function analyzeXrefs(romPath, address, platformOverride) {
     else throw e;
   }
   const out = (refs ?? []).map((r) => ({
-    from: r.from,
-    fromHex: hx(r.from),
-    to: r.to,
+    from: rb(r.from),
+    fromHex: hx(rb(r.from)),
+    to: rb(r.to),
     type: (r.type || "").toLowerCase(), // CALL / CODE / DATA / STRING
     opcode: r.opcode,
   }));
@@ -333,23 +443,25 @@ export async function analyzeXrefs(romPath, address, platformOverride) {
  * analysis pass. The "give me the shape of this ROM" call.
  */
 export async function analyzeStructure(romPath, platformOverride) {
-  const { platform, romBytes, arch, bits, loadBase } = await loadContext(romPath, platformOverride);
-  const baddr = loadBase || undefined;
+  const { platform, romBytes, arch, bits, endian, loadBase, codeStart } = await loadContext(romPath, platformOverride);
+  const { baddr, seedAt, rebase } = mipsAnalysisBase({ arch, platform, loadBase, codeStart });
+  const seed = analysisSeed({ arch, codeStart: seedAt });
   const [fns, strings, entries] = await Promise.all([
-    runRizinJson({ romBytes, arch, bits, baddr, commands: "aaa; aflj" }).catch(() => []),
-    runRizinJson({ romBytes, arch, bits, baddr, commands: "aaa; izj" }).catch(() => []),
-    runRizinJson({ romBytes, arch, bits, baddr, commands: "aaa; iej" }).catch(() => []),
+    runRizinJson({ romBytes, arch, bits, endian, baddr, commands: `${seed}; aflj` }).catch(() => []),
+    runRizinJson({ romBytes, arch, bits, endian, baddr, commands: `${seed}; izj` }).catch(() => []),
+    runRizinJson({ romBytes, arch, bits, baddr, commands: `${seed}; iej` }).catch(() => []),
   ]);
+  const rb = (a) => (a == null ? a : (a + rebase) >>> 0);
   return {
     platform, arch,
     functionCount: Array.isArray(fns) ? fns.length : 0,
     stringCount: Array.isArray(strings) ? strings.length : 0,
-    entrypoints: (Array.isArray(entries) ? entries : []).map((e) => ({ address: e.vaddr, addressHex: hx(e.vaddr) })),
+    entrypoints: (Array.isArray(entries) ? entries : []).map((e) => ({ address: rb(e.vaddr), addressHex: hx(rb(e.vaddr)) })),
     functions: (Array.isArray(fns) ? fns : []).slice(0, 512).map((f) => ({
-      address: f.offset, addressHex: hx(f.offset), name: f.name, size: f.size, callers: f.indegree ?? 0,
+      address: rb(f.offset), addressHex: hx(rb(f.offset)), name: f.name, size: f.size, callers: f.indegree ?? 0,
     })),
     strings: (Array.isArray(strings) ? strings : []).slice(0, 256).map((s) => ({
-      address: s.vaddr, addressHex: hx(s.vaddr), value: s.string,
+      address: rb(s.vaddr), addressHex: hx(rb(s.vaddr)), value: s.string,
     })),
   };
 }
@@ -507,6 +619,34 @@ export async function analyzeDecompile(romPath, address, platformOverride) {
   // to pure garbage.
   if (platform === "genesis") romBytes = deinterleaveSmd(romBytes) ?? romBytes;
 
+  // MIPS (N64/PS1): `address` is a vaddr from target='functions'. Map it to a file
+  // offset and decompile via the MIPS SLEIGH spec (MIPS:BE:32 for N64, MIPS:LE:32
+  // for PS1). N64: normalize byte order, fileOff = vaddr - entryVaddr + 0x1000 (post
+  // IPL3). PS1: strip PS-EXE, fileOff = vaddr - loadAddr.
+  if (platform === "n64" || platform === "ps1") {
+    let fileOff;
+    if (platform === "n64") {
+      romBytes = normalizeN64ByteOrder(romBytes).bytes;
+      const entry = ((romBytes[0x08] << 24) | (romBytes[0x09] << 16) | (romBytes[0x0a] << 8) | romBytes[0x0b]) >>> 0;
+      fileOff = ((address >>> 0) - entry + 0x1000) >>> 0;
+    } else {
+      let loadAddr = 0;
+      if (romBytes.length >= 0x800 && romBytes[0] === 0x50 && romBytes[1] === 0x53 && romBytes[2] === 0x2d && romBytes[3] === 0x58) {
+        loadAddr = (romBytes[0x18] | (romBytes[0x19] << 8) | (romBytes[0x1a] << 16) | (romBytes[0x1b] << 24)) >>> 0;
+        romBytes = romBytes.subarray(0x800);
+      }
+      fileOff = ((address >>> 0) - loadAddr) >>> 0;
+    }
+    if (fileOff >= romBytes.length) {
+      throw new Error(`decompile: ${platform} address ${hx(address)} maps to file offset ${hx(fileOff)}, outside the ${romBytes.length}-byte image. Use an address from target='functions'.`);
+    }
+    const rm = await decompileFunction({ platform, romBytes, fileOffset: fileOff });
+    return {
+      platform, langid: rm.langid, address, addressHex: hx(address),
+      code: prettyDecompile(rm.code, platform), warnings: rm.warnings,
+    };
+  }
+
   // SNES: banked 24-bit space. `address` is a LoROM/HiROM CPU address (what
   // target='functions'/'cfg' report). Lay the cart out by CPU address so BOTH
   // the function address AND its in-bank/JSL operands resolve, then decompile at

package/src/analysis/decompile.js

@@ -47,6 +47,10 @@ export const SLEIGH_LANGID = {
   genesis: "68000:BE:32:default",
   snes: "65816:LE:24:snes",
   pce: "HuC6280:LE:16:default",
+  // 32-bit MIPS tier. PS1 R3000 = little-endian; N64 R4300 = big-endian (games run
+  // 32-bit MIPS III code). Ghidra ships both MIPS variants in its stock SLEIGH.
+  ps1: "MIPS:LE:32:default",
+  n64: "MIPS:BE:32:default",
 };
 
 /**

package/src/analysis/decompiler/sleigh/mips.ldefs

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<language_definitions>
+  <language processor="MIPS"
+            endian="big"
+            size="32"
+            variant="default"
+            version="1.7"
+            slafile="mips32be.sla"
+            processorspec="mips32.pspec"
+            id="MIPS:BE:32:default">
+    <description>MIPS32 big endian (N64 R4300, 32-bit code)</description>
+    <compiler name="default" spec="mips32be.cspec" id="default"/>
+  </language>
+  <language processor="MIPS"
+            endian="little"
+            size="32"
+            variant="default"
+            version="1.7"
+            slafile="mips32le.sla"
+            processorspec="mips32.pspec"
+            id="MIPS:LE:32:default">
+    <description>MIPS32 little endian (PS1 R3000)</description>
+    <compiler name="default" spec="mips32le.cspec" id="default"/>
+  </language>
+</language_definitions>

package/src/analysis/decompiler/sleigh/mips32.pspec

@@ -0,0 +1,78 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<processor_spec>
+  <properties>
+    <property key="addressesDoNotAppearDirectlyInCode" value="true"/>
+    <property key="emulateInstructionStateModifierClass" value="ghidra.program.emulation.MIPSEmulateInstructionStateModifier"/>
+    <property key="assemblyRating:MIPS:BE:32:default" value="PLATINUM"/>
+  </properties>
+  <programcounter register="pc"/>
+  <context_data>
+    <context_set space="ram">
+      <set name="PAIR_INSTRUCTION_FLAG" val="0" description="1 if LWL/LWR instruction is a pair"/>
+      <set name="RELP" val="1" description="1 if mips16e, 0 if micromips"/>
+    </context_set>
+  </context_data>
+  <register_data>
+    <register name="contextreg" hidden="true"/>
+    <register name="ext_isjal" hidden="true"/>
+    <register name="ext_value" hidden="true"/>
+    <register name="ext_value_select" hidden="true"/>
+    <register name="ext_value_1005" hidden="true"/>
+    <register name="ext_value_1004" hidden="true"/>
+    <register name="ext_value_sa40" hidden="true"/>
+    <register name="ext_value_xreg" hidden="true"/>
+    <register name="ext_value_frame" hidden="true"/>
+    <register name="ext_value_areg" hidden="true"/>
+    <register name="ext_value_b0" hidden="true"/>
+    <register name="ext_value_b1" hidden="true"/>
+    <register name="ext_value_b2" hidden="true"/>
+    <register name="ext_value_b3" hidden="true"/>
+    <register name="ext_value_saz" hidden="true"/>
+    <register name="ext_value_1511" hidden="true"/>
+    <register name="ext_value_1511s" hidden="true"/>
+    <register name="ext_value_1411" hidden="true"/>
+    <register name="ext_value_1411s" hidden="true"/>
+    <register name="ext_tgt_2521" hidden="true"/>
+    <register name="ext_tgt_2016" hidden="true"/>
+    <register name="ext_is_ext" hidden="true"/>
+    <register name="ext_m16r32" hidden="true"/>
+    <register name="ext_m16r32a" hidden="true"/>
+    <register name="ext_reg_high" hidden="true"/>
+    <register name="ext_reg_low" hidden="true"/>
+    <register name="ext_svrs_xs" hidden="true"/>
+    <register name="ext_svrs_s1" hidden="true"/>
+    <register name="ext_svrs_s0" hidden="true"/>
+    <register name="ext_tgt_x" hidden="true"/>
+    <register name="ext_done" hidden="true"/>
+    <register name="ext_delay" hidden="true"/>
+    <register name="REL6" hidden="true"/>
+    <register name="RELP" hidden="true"/>
+    <register name="ext_t4" hidden="true"/>
+    <register name="ext_tra" hidden="true"/>
+    <register name="ext_32_code" hidden="true"/>
+    <register name="ext_32_codes" hidden="true"/>
+    <register name="ext_32_addim" hidden="true"/>
+    <register name="ext_32_addims" hidden="true"/>
+    <register name="ext_32_imm2" hidden="true"/>
+    <register name="ext_32_imm2s" hidden="true"/>
+    <register name="ext_32_imm3" hidden="true"/>
+    <register name="ext_32_imm3s" hidden="true"/>
+    <register name="ext_32_imm5" hidden="true"/>
+    <register name="ext_32_imm5s" hidden="true"/>
+    <register name="ext_32_imm6" hidden="true"/>
+    <register name="ext_32_rlist" hidden="true"/>
+    <register name="ext_32_base" hidden="true"/>
+    <register name="ext_32_basea" hidden="true"/>
+    <register name="ext_32_rd" hidden="true"/>
+    <register name="ext_32_rdset" hidden="true"/>
+    <register name="ext_32_rs1" hidden="true"/>
+    <register name="ext_32_rs1lo" hidden="true"/>
+    <register name="ext_32_rs1set" hidden="true"/>
+    <register name="ext_16_rs" hidden="true"/>
+    <register name="ext_16_rslo" hidden="true"/>
+    <register name="ext_16_rshi" hidden="true"/>
+    <register name="ext_off16_s" hidden="true"/>
+    <register name="ext_off16_u" hidden="true"/>
+  </register_data>
+</processor_spec>

package/src/analysis/decompiler/sleigh/mips32be.cspec

@@ -0,0 +1,107 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<compiler_spec>
+  <data_organization>
+        <pointer_size value="4"/>
+        <float_size value="4" />
+        <double_size value="8" />
+        <long_double_size value="8" />
+        <size_alignment_map>
+			<entry size="1" alignment="1" />
+			<entry size="2" alignment="2" />
+			<entry size="4" alignment="4" />
+			<entry size="8" alignment="8" />
+		</size_alignment_map>
+  </data_organization>
+
+  <stackpointer register="sp" space="ram"/>
+  <funcptr align="2"/>
+  <global>
+    <range space="ram"/>
+    <range space="register" first="0x2000" last="0x2fff"/>
+  </global>
+  <returnaddress>
+    <register name="ra"/>
+  </returnaddress>
+  <default_proto>
+    <prototype name="__stdcall" extrapop="0" stackshift="0">
+      <input>
+        <pentry minsize="1" maxsize="8" metatype="float">
+          <register name="f12_13"/>
+        </pentry>
+        <pentry minsize="1" maxsize="8" metatype="float">
+          <register name="f14_15"/>
+        </pentry>
+        <pentry minsize="1" maxsize="4">
+          <register name="a0"/>
+        </pentry>
+        <pentry minsize="1" maxsize="4">
+          <register name="a1"/>
+        </pentry>
+        <pentry minsize="1" maxsize="4">
+          <register name="a2"/>
+        </pentry>
+        <pentry minsize="1" maxsize="4">
+          <register name="a3"/>
+        </pentry>
+        <pentry minsize="1" maxsize="500" align="4">
+          <addr offset="16" space="stack"/>
+        </pentry>
+      </input>
+      <output>
+        <pentry minsize="1" maxsize="8" metatype="float">
+          <register name="f0_1"/>
+        </pentry>
+        <pentry minsize="1" maxsize="4">
+          <register name="v0"/>
+        </pentry>
+		<pentry minsize="5" maxsize="8">
+          <addr space="join" piece1="v0" piece2="v1"/>
+        </pentry>
+      </output>
+      <unaffected>
+        <register name="s0"/>
+        <register name="s1"/>
+        <register name="s2"/>
+        <register name="s3"/>
+        <register name="s4"/>
+        <register name="s5"/>
+        <register name="s6"/>
+        <register name="s7"/>
+        <register name="s8"/>
+        <register name="sp"/>
+        <register name="gp"/>
+        <register name="f20"/>
+        <register name="f22"/>
+        <register name="f24"/>
+        <register name="f26"/>
+        <register name="f28"/>
+        <register name="f30"/>
+      </unaffected>
+      <localrange>
+        <range space="stack" first="0xfff0bdc0" last="0xffffffff"/>
+        <range space="stack" first="0" last="15"/>  <!-- This is backup storage space for register params, but we treat as locals -->
+      </localrange>
+    </prototype>
+  </default_proto>
+  <prototype name="processEntry" extrapop="0" stackshift="0"> 
+      <input pointermax="4"> 
+        <pentry minsize="1" maxsize="4"> 
+          <register name="v0"/> 
+        </pentry> 
+        <pentry minsize="1" maxsize="500" align="4"> 
+          <addr offset="0" space="stack"/> 
+        </pentry> 
+      </input> 
+      <output killedbycall="true"> 
+        <pentry minsize="1" maxsize="4"> 
+          <register name="v0"/> 
+        </pentry> 
+      </output> 
+      <unaffected>
+        <register name="sp"/>
+      </unaffected>
+  </prototype> 
+
+    
+</compiler_spec>