docs(amiga): complete AmigaOS 3.1/3.2 developer reference — 172 files across 17 sections

Comprehensive technical documentation covering: - Hardware: OCS/ECS/AGA custom chip registers, Copper & Blitter deep dives - Boot sequence: cold boot through startup-sequence - Binary format: HUNK executable spec, relocation, debug info - Linking & ABI: .fd files, LVO tables, register calling conventions - Exec kernel: tasks, interrupts, memory, signals, semaphores - AmigaDOS: file I/O, FFS/OFS layout, CLI/Shell scripting - Graphics: planar bitmaps, Copper programming, HAM/EHB modes - Intuition: screens, windows, IDCMP, BOOPSI - Devices: trackdisk, SCSI, serial, timer, audio, keyboard - Libraries: utility, expansion, IFFParse, locale, ARexx - Networking: bsdsocket API, SANA-II, TCP/IP stack comparison - Toolchain: GCC, vasm/vlink, SAS/C, NDK, debugging - Reverse engineering: IDA/Ghidra setup, compiler fingerprints, case studies - CPU & MMU: 68040/060 emulation libs, PMMU, cache management - Driver development: SANA-II, Picasso96/RTG, AHI audio All files include breadcrumb navigation. No local paths or proprietary content.
2026-06-13 00:26:28 +00:00 · 2026-04-23 12:16:52 -04:00 · 2026-04-23 12:16:52 -04:00 · 21751c0025
commit 21751c0025
parent f07a368bf1
172 changed files with 19701 additions and 0 deletions
--- a/05_reversing/dynamic/live_memory_probing.md
+++ b/05_reversing/dynamic/live_memory_probing.md
@ -0,0 +1,132 @@
+[← Home](../../README.md) · [Reverse Engineering](../README.md)
+
+# Live Memory Probing
+
+## Overview
+
+Live memory probing on a running Amiga means directly reading exec structures — `SysBase`, `LibList`, `TaskReady`, `MemList` — to observe system state without a traditional debugger.
+
+---
+
+## SysBase: The Root of Everything
+
+`SysBase` is always at absolute address `$4` (a pointer to the `ExecBase` structure):
+
+```c
+struct ExecBase *SysBase = *((struct ExecBase **)4);
+printf("exec version: %d.%d\n",
+       SysBase->LibNode.lib_Version,
+       SysBase->LibNode.lib_Revision);
+```
+
+In assembly:
+```asm
+MOVEA.L  4.W, A6              ; A6 = SysBase (exec.library base)
+MOVE.W   ($16,A6), D0         ; lib_Version
+MOVE.W   ($18,A6), D1         ; lib_Revision
+```
+
+---
+
+## Walking the Library List
+
+```c
+struct Node *n = SysBase->LibList.lh_Head;
+while (n->ln_Succ != NULL) {
+    struct Library *lib = (struct Library *)n;
+    printf("%-30s v%d.%d  opens=%d\n",
+           lib->lib_Node.ln_Name,
+           lib->lib_Version, lib->lib_Revision,
+           lib->lib_OpenCnt);
+    n = n->ln_Succ;
+}
+```
+
+This enumerates all currently loaded libraries. Useful for:
+- Finding if a target library is loaded
+- Reading `lib_OpenCnt` to detect if your hook is installed
+- Checking `lib_Flags & LIBF_DELEXP` (expunge pending)
+
+---
+
+## Reading `lib_OpenCnt` Live
+
+```c
+/* Check if bsdsocket.library is loaded and its open count */
+struct Library *base = FindName(&SysBase->LibList, "bsdsocket.library");
+if (base) {
+    printf("bsdsocket: OpenCnt=%d, Version=%d\n",
+           base->lib_OpenCnt, base->lib_Version);
+}
+```
+
+`FindName` scans `ln_Name` in a linked list — it is an exec function at LVO −276.
+
+---
+
+## Memory Region Map
+
+`SysBase->MemList` lists all memory regions:
+
+```c
+struct MemHeader *mh = (struct MemHeader *)SysBase->MemList.lh_Head;
+while (mh->mh_Node.ln_Succ) {
+    printf("Region: %s  %08lx–%08lx  free=%ld\n",
+           mh->mh_Node.ln_Name,
+           (ULONG)mh->mh_Lower,
+           (ULONG)mh->mh_Upper,
+           mh->mh_Free);
+    mh = (struct MemHeader *)mh->mh_Node.ln_Succ;
+}
+```
+
+Output example:
+```
+Region: chip memory   $000000–$1FFFFF  free=524288
+Region: fast memory   $200000–$9FFFFF  free=6291456
+```
+
+---
+
+## Task List Inspection
+
+```c
+/* Running tasks: */
+Forbid();
+struct Task *t = (struct Task *)SysBase->TaskReady.lh_Head;
+while (t->tc_Node.ln_Succ) {
+    printf("Task: %-20s pri=%d state=%d\n",
+           t->tc_Node.ln_Name,
+           t->tc_Node.ln_Pri,
+           t->tc_State);
+    t = (struct Task *)t->tc_Node.ln_Succ;
+}
+Permit();
+```
+
+`Forbid()` / `Permit()` are mandatory — the task list must not change while walking it.
+
+---
+
+## Patching Memory Live (Surgical Writes)
+
+For RE/patching: direct longword write to an OS structure:
+
+```c
+/* Example: force a library's version to 99 */
+Forbid();
+target_lib->lib_Version = 99;
+Permit();
+```
+
+> [!CAUTION]
+> Direct memory writes to OS structures bypass all synchronization. Always use `Forbid()` at minimum; use `Disable()` if modifying interrupt-visible data.
+
+---
+
+## References
+
+- NDK39: `exec/execbase.h`, `exec/memory.h`, `exec/tasks.h`
+- `06_exec_os/exec_base.md` — full ExecBase offset table
+- `06_exec_os/memory_management.md` — MemHeader structure
+- `05_reversing/dynamic/setfunction_patching.md` — Forbid/Permit patterns