57 lines
3.4 KiB
Markdown
57 lines
3.4 KiB
Markdown
# MAG160C 全量逆向进度跟踪 (2026-08-12 深夜轮)
|
||
# 心跳: 每阶段写文件, 中断可恢复
|
||
|
||
## 本轮新增结论(2026-08-12 深夜)
|
||
- [x] 平滑器 0x1800011a0 完整: 模式1=memcpy, 模式2=EMA(1/2),
|
||
模式4+=计数1-3只累加(缓冲C u32), 计数==模式输出 acc>>shift, 计数清零acc保留
|
||
- [x] 平滑器对象: dev+0x41ee0(模式=0x41fd8=4, 缓冲A/B=refp, C=acc),
|
||
dev+0x41f10(模式=0x41fdc=1直通, A/B=f20p), 0x41f40(0x41fe0=1),
|
||
0x41f80(0x41fe4=5); 结构 [+0]=vtable [+8]A [+0x10]B [+0x18]C [+0x20]cnt
|
||
[+0x24]pix [+0x28]mode [+0x2c]enable
|
||
- [x] ref(0x41ef0) = 平滑器0x41ee0输出 = acc>>2, acc=5.41帧累加(启动时推帧~22次)
|
||
ref ≈ f20+3875(常数), mura相同(corr 0.998), FFC时更新(全局-145/-214)
|
||
- [x] USB帧线程(0x18000a0xx): 帧计数(0x73bec)分支:
|
||
1-5帧: 0x18000c760(校正表生成); 6-9帧: 0x18000c620(推帧0x41ee0)+0x18000c760;
|
||
帧==9: 发FFC(0x6bb6b672,1); 10+: 0x18000ca30(主处理)
|
||
流参数: 2d78=4 2d88=5 2d8c=4 2d90=1800 2d94=250
|
||
- [x] 帧处理主链: USB线程 → 0x18000ca30(ebx==1直通, 否则0x18000c950)
|
||
→ 0x18000c950: 0x41f10平滑器 → 0x180017200(NUC查表) → 0x180017330(3x3)
|
||
→ 0x18001e920(0x41f40) → 0x180010780(温度) → 0x1800109c0(窗口) → 放大
|
||
- [x] 0x180017200 NUC查表: A=*(dev+0x41f20)=f20, B=*(dev+0x41ef0)=ref
|
||
d=(f20-ref)>>1; 阈值表=*(dev+0x41858)(3项s16); 增益表=*(dev+0x41870)
|
||
(nsegs×19200×(gain u16, off u16)); out=gain×d>>12+off(0x11c=12), clamp
|
||
nsegs=0x41554=3; 0x41840=3(端点索引); 断点0x41564/0x41568
|
||
- [x] 表生成: 0x41848/0x41850 = 端点表1, 0x41858 = 插值输出(阈值表)
|
||
0x41860/0x41868 = 端点表2, 0x41870 = 插值输出(增益表)
|
||
0x180016dd0/0x180016f10 = 分段线性插值(按dev+0x54值在断点间插值)
|
||
0x180016ae0 = 端点表初始化(帧0, 加载配置0x417xx区域)
|
||
表每帧更新(温度相关)
|
||
- [x] 0x180017330 3x3: 表驱动(0x41878指针, 0x41654项), 8邻域加权平均
|
||
case0: 8点平均>>3; case1+: 加权(1/3,1/6,1/7等)
|
||
- [x] 窗口: lo=min(max,mean-312) hi=max(min,mean+312) X=624(每帧统计后)
|
||
- [x] 灰度: idx=(nuc-lo)*0xFFC00000/(hi-lo)>>22, gray=LUT1024[dev+0x4284c]
|
||
- [x] 温度: temp_mC = T2E[3*raw - C], C~5797
|
||
|
||
## 实测关键数据(pairs_nuc2)
|
||
- nuc(0x270): mean~9706 std~41 时域噪声13.7
|
||
- f20(0x41f20): mean~10855 std~3639(≈USB帧, 含mura)
|
||
- ref(0x41ef0): mean~14654 std~3656(= f20+3875)
|
||
- d2=(f20-ref)>>1: std~114, 与nuc相关性仅0.04!!
|
||
- 官方nuc主体不是d2的线性函数; 线性最优斜率0.04-0.19(MAD 23-47)
|
||
- gain表(0x41870): seg1增益均值3352(≈0.82×4096), 偏移≈9660(≈nuc)
|
||
- off表与nuc相关性低(0.2/-0.47/0.1)
|
||
- 线性近似重建gray误差11-20级(不可用) → 官方查表强非线性必需
|
||
|
||
## demo3 问题根因(用户反馈: 颗粒感+FFC变色)
|
||
1. 颗粒感: demo3 nuc=(live-ref)*3+comp 斜率3 vs 官方~0.1-0.8 → 噪声/对比放大3-27倍
|
||
2. FFC变色: demo3 ref采集(30帧中值)时机/方式与官方(启动22帧累加+FFC更新)不同;
|
||
FFC后基线漂移期间旧ref不匹配 → nuc爆炸 → 花屏
|
||
3. 像素偏移bug已修(+0), 3x3双向滤波已加, 冻结显示已加
|
||
|
||
## 下一步(未完成)
|
||
- [ ] 精确确定官方nuc对d2的斜率/查表(需要热源场景或更多分析)
|
||
- [ ] demo3按官方斜率修改并实机验证
|
||
- [ ] 0x180016ae0端点表初始化(0x417xx配置)完整逆向
|
||
- [ ] FFC状态机(0x73bf4, 帧号75/130)
|
||
- [ ] ThermalSDK.dll完整逆向
|