Hello trid users,
some days ago i looked inside my qemu directory. There i found a file
with name extension aml which is not recognized by TrID. So i look for
more such files on my systems. When i run trid on such and similar
files these are described as "Unknown!" ( see appended
output/trid-old.txt)
According to websites file-extensions.org and fileinfo.com such files
are ACPI Machine Language files. So i use that description in
definitions generated by tridscan.
Some information is found on ACPI page on Wikipedia. That is expressed
by reference URL line like:
<RefURL>
https://en.wikipedia.org/wiki/Advanced_Configuration_and_Power_Interface </RefURL>
According to the mentioned Advanced Configuration and Power Interface
Specification i began to refine the definition. My few real examples are
Differentiated System Description Tables, which are characterized at the
beginning by pattern:
<Bytes>44534454</Bytes>
<ASCII> D S D T</ASCII>
My examples were created by iasl(1) ACPI tool found on acpica.org web
site. This tool use the Vendor INTL. So i first found pattern like:
<Bytes>000000494E544C</Bytes>
<ASCII> . . . I N T L</ASCII>
<Pos>25</Pos>
But for similar files like SLIC.bin i also found vendor ID MSFT ( See
appended output/file-new.txt) So i removed that pattern.
According to specification revision byte at offset 8 has a meaning for
the AML interpreter. Values less than two will cause the interpreter
to use 32-bit integers and math. Values of two and greater will cause
the interpreter to use full 64-bit integers and math. For my examples
i only found value 1 and 2. So generate two variants. The first
aml-DSDT-v1.trid.xml is for 32 bit with additional pattern
<Bytes>01</Bytes>
<Pos>8</Pos>
The second is for 64 bit with additional pattern:
<Bytes>02</Bytes>
<Pos>8</Pos>
I do not know if other revision numbers are used, but i mention these
facts in the remark line. Furthermore with this additional pattern
random ASCII text like DSDT.text starting with phrase DSDT are
skipped.
The size of such ACPI tables is stored as 4 byte integer at offset
4. So in theory the upper limit limit is 4 GiB, but in reality only
lower sizes like 21469 appear. Because ACPI tables are part of PC BIOS
i assume that ACPI tables size are lower than 16 MiB. That means upper
is null. That is expressed by XML construct:
<Bytes>00</Bytes>
<Pos>7</Pos>
By this additional pattern also bad ASCII text samples are skipped.
On Linux systems such tables from BIOS can be generated by command
like:
cat /sys/firmwar/acpi/tables/DSDT MyDSDT.aml`
With the 2 new trid definitions all my inspected AML samples are
now described ( see appended output/trid-new.txt)
TrID definitions, output and some are stored in archive aml.zip. I
hope that my new 2 XML files can be used in future version of
triddefs.
With best wishes
Jörg Jenderek
