2026-02-18
What happened
Wrote up a detailed plan for porting the decompiled firmware to compilable C running on Linux. The target is a working emulator with ncurses LCD display — not cycle-accurate hardware simulation, just the firmware logic running natively.
The plan splits into four layers:
HAL (mmt8_hal.h/c) — replaces 8051 hardware with C arrays and macros. XDATA[65536], IRAM[256], named #defines for all documented IRAM locations, P2-page access macros for MOVX @Ri, and an io_write(addr, val) dispatch for memory-mapped I/O. Ghidra emits several pseudo-ops (CONCAT11, SUB21, ZEXT12, CARRY1) that need macro replacements.
LCD emulation (lcd_emu.h/c) — HD44780 state machine feeding into an ncurses window. The firmware never reads the busy flag (it uses software delay loops), so we can always return not-busy.
Core transform (mmt8_core.c) — mechanical substitution first (Python script for the repetitive parts: undefined1 → uint8_t, DAT_IRAM_XX → named macros, I/O writes → io_write()), then manual fixup for the 8051 idioms that don't map cleanly: the LCALL/string trick, register bank switching (ISRs use banks 2 and 3 for zero-overhead context saves), and indirect jumps.
Main entry (main.c) — init ncurses, load the ROM binary into CODE[], call the firmware init, then run the main loop with wall-clock-based timer simulation.
The main risk is sequence_playback_engine — 1,513 bytes, calls about 25 functions, mix of 8-bit and 16-bit pointer arithmetic throughout. That one will need the most manual attention.
commit: c4c0c5b