Skip to content

ENCOS Ethernet II firmware - embedded symbol table (extracted 2026-07-26)

The 68000 firmware image carries its own linker symbol table. Complete extraction: 255 records, 241 unique names.

These are Norsk Data's OWN names for their routines and data objects. They beat anything a reverse engineer would invent, and they are the fastest route to a readable disassembly of this image. 191 have been applied to the Ghidra database; see "What was applied".

Provenance

Source binary ..\encos-ser-all-banks-68k.bin (524,288 bytes, MC68000 big-endian, load base 0x0)
Table location file offset 0x663E0 .. 0x689FF
Record stride 32 bytes, 32-byte aligned
Extracted 2026-07-26, by direct byte scan of the image

TWO BLOCKS - read this before using an address

The table is in two parts, and only the second has usable flat addresses.

Block File range Records Trailing link Addresses
unbound 0x663E0 - 0x665BF 14 ff ff 00 00 segment-relative; several are 0x08xxxxxx and are NOT load addresses
bound 0x66BE0 - 0x689FF 241 18 00 <off>, <off> = file offset - 0x663A0 flat, directly usable

Link formula verified: record at 0x66BE0 carries 18 00 08 40, and 0x66BE0 - 0x663A0 = 0x840; 0x66C00 carries 18 00 08 60 -> 0x860. The gap 0x665C0 - 0x66BDF is zero fill.

Do not apply an unbound-block address without checking it. Some are real (ND100_CPU -> 0x64E is the ND-100 system-number config cell, independently confirmed); others such as END_SYSTEM -> 0x4660 are segment markers that collide with a real routine (0x4660 is calc_crc32), and applying them would destroy a correct name.

Record layout [V - verified by decoding and cross-checking]

 +0      1  name length (observed 1..12). NAMES ARE TRUNCATED TO 12 CHARS.
 +1      1  flag. Observed 0x00 and 0x10 only. UNDECODED - would need the ND linker.
 +2      1  0x02 = defined (236 records); 0xff = external / segment marker (19 records)
 +3      1  segment / class. 0x10 = code, 0x16 = card DRAM data; others rare (see below)
 +4..7   4  32-bit address, big-endian
 +8..11  4  always zero in every record observed
 +12..   n  name, `name length` bytes, ASCII, not NUL-terminated
 +26..31 6  trailing link - see the two-block table above

Verification: INITLANCE -> 0x48EA and the routine there programs the LANCE; LANCEINITB -> 0x18810 is the LANCE init block; LNMAPHYSIC -> 0x1885E is the station MAC buffer. All three were established independently by disassembly before this table was found. Spot checks at 0x70CC, 0xB46A, 0x10772 all land exactly on 2F 0E (move.l A6,-(SP)), the PLANC prologue - no symbol lands mid-instruction.

Caveats

  • Names are truncated to 12 characters. LNMAPHYSIC is LNMAPHYSICALADDRESS; RCVCOMPLET is RCVCOMPLETE; XMTRINGAPP is XMTRINGAPPEND. Where the full name is known from elsewhere, the longer form is more faithful - the truncation is the table's, not the vendor's.
  • Duplicate names are legitimate - same name at different addresses in different segments (BUFFER_END x3, BUFFER_STA x3, END_FREE x2). Match on segment as well as name.
  • The +1 byte is undecoded; +2 and +3 meanings are inferred from distribution, not read from linker code. Treat the segment mapping as a working hypothesis.

What was applied to Ghidra

A first naming pass applied ~191 names. Two later verification passes - one for code, one for data - checked every bound record and completed the work. All 227 in-scope records (144 code + 83 data) now carry their vendor name. The three categories deliberately never applied are the 19 +2 = 0xff markers, the 14 unbound-block records, and any address where a longer un-truncated form of the same vendor identifier already existed.

Verification pass (2026-07-26, first agent) - code half, segment 0x10

In scope (seg 0x10, +2 = 0x02, bound) 144
Already correct 57
Renamed from a reverse-engineer's invented name 16
Newly created as functions (bytes were undefined, or code with no function) 71
Skipped 3 (the +2 = 0xff markers in this segment)
Failed 0

Program function count went 187 -> 288, verified by a full list_functions re-read afterwards. So the first pass had labelled many code addresses without creating functions there; this pass fixed that.

Notable groups recovered:

  • The card's own XMSG primitive layer: XMPFOPN, XMPFGET, XMPFGST, XMPFWRI, XMPFRCV, XMPFRTN, XMPFPRV, XMPFDUM, XMPFDCT, XMPFALM, XMPFMST, XMPFPST, XMPOPNM, XMPCLNM, XMPREAD, XMPWRTE, XMPROUT and ~15 more. Note XMPFDUM / XMPFDCT mirror the host-side XFDUM / XFDCT MON 200B function names - the card runs its own XMSG primitive set.
  • The PLANC runtime, under the vendor's own #-prefixed names: #APPD, #REMV, #MOVE, #IMU, #IDV, #IMOD, #INBY, #UTBY, #GETNO, #OUTBYT, #ERROR, #SPASI, #XRET, #ERET, #PRERR, #INSE, #BCPC, #UTI4, #INBYT. (Ghidra accepts # in symbol names.)
  • Monitor-call stubs MON0, MON1, MON2, MON64, MON65.
  • PIOCOS processes POMNPROCES @ 0x7BA2 and POCSPROCES @ 0xE380 - which independently confirm the process directory the data pass found at POGDPROCES (0x2D338), where those same two code addresses appear as directory entries.

Address-quality verdict: high. 144 of 144 landed on a valid instruction boundary and 141 on the exact 2F 0E (move.l A6,-(SP)) PLANC prologue. The three that do not are structurally explicable - MON65 is a one-instruction jsr thunk, MON0 is moveq #0,D0 ; trap #2, and MON64 falls through into them. Computed function bodies tile sensibly: REINITRING (0x5722-0x5847) ends exactly one byte before STARTMA at 0x5850.

One anchor correction worth carrying forward: an earlier pass named 0x6ECE LNMAINIT_main. The vendor's LNMAINIT is at 0x6EAA, a different 14-byte routine. Both now exist; 0x6ECE keeps its invented name with the relationship noted in its comment. Do not treat 0x6ECE as LNMAINIT.

Verification pass (2026-07-26, second agent) - data half

All 83 in-scope segment-0x16 records (+2 = 0x02, bound block) were confirmed already correctly named - the naming claim holds up, nothing was missing. 83 + 7 markers = 90 reconciles exactly with the segment-0x16 count, so that enumeration is provably complete. No record in the rarer segments (0x26 / 0x01 / 0x05 / 0x11 / 0x20) qualifies - every one is either unbound or a 0xff marker. The data half is therefore entirely segment 0x16.

What verification did find was three defects the naming pass had left behind:

  1. POMNON @ 0x19BBA was typed as a 4-byte pointer, which swallowed POMNSTATUS @ 0x19BBC. The apparent pointer value 0x00010000 was never a pointer - it is POMNON = 1 followed by POMNSTATUS = 0. Proved by instruction size: POMNERHANDLER does tst.w (0x19bba).l at 0x705C and clr.w (0x19bba).l at 0x7084. Retyped undefined2; the second symbol is now visible.
  2. LNCNSPCOMM @ 0x1A268 was a spurious function whose body (0x1A268-0x1A28F) buried LNCNSPDATA @ 0x1A27C.
  3. POCONFIGUR @ 0x2D350 was a spurious function whose body (0x2D350-0x2D357) buried PODIRECTOR @ 0x2D354.

Resolved: 0x1A268 and 0x2D350 are DATA, not functions. Evidence identical for both - zero-filled card DRAM, no callers at all, and the "instructions" are the classic all-zero decode artefact (00 00 00 00 -> ori.b #0x0,D0b repeated). Both function bodies were removed so the concealed symbols could be applied. That is the only destructive edit made during the pass.

35 data types applied, each justified either by the distance to the next vendor symbol or by an instruction's operand size - 7 x undefined2 (16-bit cells) and 28 x undefined4 (mostly queue and list heads). 13 symbols were deliberately left label-only: LNMASPCOMM, LNMASPDATA, POMNSTACK, POMNSTATUS, POGDSTATUS, POGDPROCES, PONAPOOL, PORTPIOCPO, PORT100POO, PO100MSGTY, POMS100POO, POMS100BUF, XMFSTACK - the gap to the next symbol is 16-100+ bytes and these are records, pools or stacks whose extent the code does not evidence. Naming them is right; sizing them would be a guess.

Weakest claim in that pass, flagged by its author: the Q* cells at 0x1AAA6, 0x1B22A, 0x1E22A and 0x6632C have no following symbol to bound them and were typed undefined4 on family evidence (every other member of the same queue-head run is a 4-byte list head). Inference, not proof.

No conflicts. Notably, the heavily-documented reverse-engineered names - g_maOperatingMode (0x18886), g_maAddressFilterOn (0x18888), g_mode8023LengthField (0x1888A), rxpool_count (0x188C6), the group-address list heads (0x18942 / 0x1893E) - have no vendor-table entry at all, so they survive untouched with their comments. The Am7990InitBlock structure at 0x18810, the byte[6] at 0x1885E and the ring header at 0x18000 are likewise intact.

Side finding: the bytes at POGDPROCES (0x2D338) are the live PIOCOS process directory - readable 4-char process tags POMN and POCS, each followed by an 0x80xx word and a code address (0x7BA2 = POMNPROCESS, 0xE380 = POCSPROCESS).

Distribution

Segment (byte +3) Count Address range Example
0x10 147 0x4660 .. 0x13748 END_SYSTEM
0x16 90 0x0 .. 0x663DC NIL
0x26 5 0x64C .. 0x1A00 END_FREE
0x01 4 0x0 .. 0x8002856 PIUSERMAIN
0x05 4 0x80027AC .. 0x80035FC BUFFER_END
0x11 4 0x0 .. 0x0 NONE_1
0x20 1 0x4660 .. 0x4660 END_SYSTEM

Full symbol table, sorted by address

Blk u = unbound (address suspect). +2 = 0xff means segment marker, not a real location.

Address Name Seg +1 +2 Blk File offset
0x000000 NIL 0x16 0x00 0xff 0x66BE0
0x000000 NONE_0 0x11 0x10 0xff 0x66C20
0x000000 NONE_0 0x01 0x10 0xff u 0x665A0
0x000000 NONE_1 0x11 0x10 0xff 0x66C00
0x000000 NONE_1 0x01 0x10 0xff u 0x66580
0x000000 NONE_2 0x11 0x10 0xff 0x66C60
0x000000 NONE_3 0x11 0x10 0xff 0x66C40
0x00064C PIOC_NUMBE 0x16 0x00 0x02 0x66C80
0x00064C PIOC_NUMBE 0x26 0x00 0x02 u 0x66540
0x00064E ND100_CPU 0x26 0x00 0x02 u 0x66560
0x00064E ND100_CPU 0x16 0x00 0x02 0x66CA0
0x000FC2 REALTIME 0x26 0x10 0x02 u 0x66460
0x000FC2 REALTIME 0x16 0x00 0x02 0x66CC0
0x0012F4 BUFFER_STA 0x16 0x10 0xff 0x66D00
0x0012F4 START_FREE 0x16 0x00 0xff 0x66CE0
0x0012F4 START_FREE 0x26 0x00 0xff u 0x66440
0x001A00 BUFFER_END 0x16 0x10 0xff 0x66D40
0x001A00 END_FREE 0x16 0x00 0xff 0x66D20
0x001A00 END_FREE 0x26 0x00 0xff u 0x66400
0x004660 END_PIOCOS 0x10 0x10 0xff 0x66D80
0x004660 END_SYSTEM 0x10 0x00 0xff 0x66D60
0x004660 END_SYSTEM 0x20 0x00 0xff u 0x664C0
0x0047F8 INTLANCE 0x10 0x00 0x02 0x66DA0
0x00485A INTPROTECT 0x10 0x00 0x02 0x66DC0
0x00487A STARTIO 0x10 0x00 0x02 0x66DE0
0x0048EA INITLANCE 0x10 0x00 0x02 0x66E00
0x004C26 FATALERROR 0x10 0x00 0x02 0x66E20
0x004D66 ASRCONNECT 0x10 0x00 0x02 0x66E40
0x004E42 WAIT 0x10 0x10 0x02 0x66E60
0x005722 REINITRING 0x10 0x00 0x02 0x66E80
0x005850 STARTMA 0x10 0x00 0x02 0x66EA0
0x005880 STOPMA 0x10 0x00 0x02 0x66EC0
0x0058E0 HARDWAREER 0x10 0x00 0x02 0x66EE0
0x005AC6 WATCHDOGDE 0x10 0x00 0x02 0x66F00
0x005B60 RCVRINGAPP 0x10 0x00 0x02 0x66F20
0x005C42 RCVCOMPLET 0x10 0x10 0x02 0x66F40
0x006054 XMTRINGAPP 0x10 0x00 0x02 0x66F60
0x0061D2 XMTCOMPLET 0x10 0x10 0x02 0x66F80
0x0064C4 IOCOMPLETI 0x10 0x00 0x02 0x66FA0
0x00659C CMDSERVICE 0x10 0x10 0x02 0x66FC0
0x006ACA DATASERVIC 0x10 0x10 0x02 0x66FE0
0x006DA8 LNMAEVENTS 0x10 0x00 0x02 0x67000
0x006EAA LNMAINIT 0x10 0x00 0x02 0x67020
0x00704A POMNERHAND 0x10 0x00 0x02 0x67040
0x0070CC SENDERROR 0x10 0x00 0x02 0x67060
0x0072CA GETALLERRO 0x10 0x00 0x02 0x67080
0x0073A0 ANALYZEEVE 0x10 0x00 0x02 0x670A0
0x007412 CONNECTERR 0x10 0x00 0x02 0x670C0
0x007528 INITERRORS 0x10 0x00 0x02 0x670E0
0x0076C4 INITSUPERK 0x10 0x00 0x02 0x67100
0x007776 INITRESOUR 0x10 0x00 0x02 0x67120
0x007BA2 POMNPROCES 0x10 0x00 0x02 0x67140
0x007E0E AUTO_START 0x10 0x00 0x02 0x67180
0x007E0E PIUSERMAIN 0x10 0x10 0xff 0x67160
0x00B1EE LNCNEVENTS 0x10 0x00 0x02 0x671A0
0x00B46A LNCNINIT 0x10 0x00 0x02 0x671C0
0x00BCDE COPY 0x10 0x00 0x02 0x671E0
0x00BD32 XMSGIOCGAT 0x10 0x00 0x02 0x67200
0x00BED8 XMRECEIVER 0x10 0x00 0x02 0x67220
0x00BF6A RECEIVEREA 0x10 0x00 0x02 0x67240
0x00CD4A PROCESSXRO 0x10 0x00 0x02 0x67260
0x00D1FC PROCESSXGA 0x10 0x00 0x02 0x67280
0x00D4C0 PROCESSXMS 0x10 0x00 0x02 0x672A0
0x00E24E CSEVENTS 0x10 0x00 0x02 0x672C0
0x00E380 POCSPROCES 0x10 0x00 0x02 0x672E0
0x00E6B0 POWAITFORL 0x10 0x10 0x02 0x67300
0x00E73C PORTCREATE 0x10 0x10 0x02 0x67320
0x00E8F4 PORTNAME 0x10 0x10 0x02 0x67340
0x00E940 PORTCONNEC 0x10 0x10 0x02 0x67360
0x00E994 PORTRECEIV 0x10 0x10 0x02 0x67380
0x00EAA6 PORTSEND 0x10 0x10 0x02 0x673A0
0x00ED10 PONAREGIST 0x10 0x10 0x02 0x673C0
0x00EE48 PONALOOKUP 0x10 0x10 0x02 0x673E0
0x00EF68 POMSGETMES 0x10 0x10 0x02 0x67400
0x00F05A LNNDTOMAAP 0x10 0x10 0x02 0x67420
0x00F0AE LNNDFROMMA 0x10 0x10 0x02 0x67440
0x00F182 LNINHEXMAA 0x10 0x10 0x02 0x67460
0x00F316 LNOUTHEXMA 0x10 0x10 0x02 0x67480
0x00F4A2 LNPRINTMAS 0x10 0x10 0x02 0x674A0
0x00FCC4 XMPOPNM 0x10 0x10 0x02 0x674C0
0x00FF64 XMPCLNM 0x10 0x00 0x02 0x674E0
0x00FF94 XMPOPCN 0x10 0x00 0x02 0x67500
0x010302 XMPINFC 0x10 0x00 0x02 0x67520
0x010478 XMPREAD 0x10 0x00 0x02 0x67540
0x01050C XMPWRTE 0x10 0x00 0x02 0x67560
0x0105A0 XMPRDHD 0x10 0x00 0x02 0x67580
0x0105E0 XMPWRHD 0x10 0x00 0x02 0x675A0
0x010666 XMPROUT 0x10 0x10 0x02 0x675C0
0x0106F0 XMPSEND 0x10 0x00 0x02 0x675E0
0x010772 XMPFOPN 0x10 0x10 0x02 0x67600
0x0107CA XMPFCLS 0x10 0x10 0x02 0x67620
0x010820 XMPFGET 0x10 0x10 0x02 0x67640
0x010880 XMPFREL 0x10 0x10 0x02 0x67660
0x0108D6 XMPFGST 0x10 0x10 0x02 0x67680
0x010936 XMPFREA 0x10 0x10 0x02 0x676A0
0x0109AA XMPFWRI 0x10 0x10 0x02 0x676C0
0x010A1E XMPFRHD 0x10 0x10 0x02 0x676E0
0x010A86 XMPFWHD 0x10 0x10 0x02 0x67700
0x010AE6 XMPFSND 0x10 0x10 0x02 0x67720
0x010B42 XMPFRTN 0x10 0x10 0x02 0x67740
0x010BA6 XMPFRCV 0x10 0x10 0x02 0x67760
0x010C4C XMPFRRE 0x10 0x10 0x02 0x67780
0x010D06 XMPFRRH 0x10 0x00 0x02 0x677A0
0x010DAC XMPFPST 0x10 0x00 0x02 0x677C0
0x010E32 XMPFMST 0x10 0x10 0x02 0x677E0
0x010EAA XMPFSCM 0x10 0x10 0x02 0x67800
0x010F08 XMPFP2M 0x10 0x10 0x02 0x67820
0x010F64 XMPFPRV 0x10 0x10 0x02 0x67840
0x010FBA XMPFDMM 0x10 0x00 0x02 0x67860
0x011010 XMPFALM 0x10 0x00 0x02 0x67880
0x01106E XMPFDUM 0x10 0x00 0x02 0x678A0
0x0110BC XMPFDCT 0x10 0x00 0x02 0x678C0
0x01110A XMPBLET 0x10 0x00 0x02 0x678E0
0x011236 XMPBINI 0x10 0x10 0x02 0x67900
0x0112B0 XMPBRDY 0x10 0x10 0x02 0x67920
0x011312 XMPBAIN 0x10 0x10 0x02 0x67940
0x0113E2 XMPBADB 0x10 0x10 0x02 0x67960
0x011502 XMPBAST 0x10 0x10 0x02 0x67980
0x01164E XMPXETS 0x10 0x10 0x02 0x679A0
0x011682 XMPXRTS 0x10 0x10 0x02 0x679C0
0x0116C2 XMPBLENGTH 0x10 0x10 0x02 0x679E0
0x0116E4 POSPINITIA 0x10 0x10 0x02 0x67A00
0x011732 POSIINITIA 0x10 0x10 0x02 0x67A20
0x01176A POSPSTART 0x10 0x00 0x02 0x67A40
0x01179C POSISTART 0x10 0x10 0x02 0x67A60
0x0117CE POSPSTOP 0x10 0x00 0x02 0x67A80
0x01183C POSISTOP 0x10 0x10 0x02 0x67AA0
0x01186C POSPGETNEX 0x10 0x10 0x02 0x67AC0
0x0118EA POSIGETNEX 0x10 0x10 0x02 0x67AE0
0x01192A POSPGETALL 0x10 0x10 0x02 0x67B00
0x01199E POSIGETALL 0x10 0x10 0x02 0x67B20
0x011A76 POSPRETURN 0x10 0x10 0x02 0x67B40
0x011C66 POSIRETURN 0x10 0x10 0x02 0x67B60
0x011CD8 POSPAPPEND 0x10 0x10 0x02 0x67B80
0x011DC4 POSIAPPEND 0x10 0x10 0x02 0x67BA0
0x011E2A POSPREMOVE 0x10 0x10 0x02 0x67BC0
0x011EF2 POSIREMOVE 0x10 0x10 0x02 0x67BE0
0x011F78 POMNREPORT 0x10 0x10 0x02 0x67C00
0x012168 POLKLOCK 0x10 0x10 0x02 0x67C20
0x012212 POLKUNLOCK 0x10 0x10 0x02 0x67C40
0x01222E PIOCOS 0x10 0x10 0x02 0x67C60
0x012258 PO32TOSTRI 0x10 0x10 0x02 0x67C80
0x01249A #INBY 0x10 0x10 0x02 0x67CA0
0x012644 #UTBY 0x10 0x10 0x02 0x67CC0
0x01289E #UTI4 0x10 0x10 0x02 0x67CE0
0x012ED8 #SPASI 0x10 0x10 0x02 0x67D00
0x012FA6 #ERROR 0x10 0x10 0x02 0x67D20
0x01302A #GETNO 0x10 0x10 0x02 0x67D40
0x01309E #OUTBYT 0x10 0x10 0x02 0x67D60
0x0130CC #INBYT 0x10 0x10 0x02 0x67D80
0x01310C #IMOD 0x10 0x10 0x02 0x67DA0
0x013148 #BCPC 0x10 0x10 0x02 0x67DC0
0x013286 #MOVE 0x10 0x10 0x02 0x67DE0
0x0133E6 #IMU 0x10 0x10 0x02 0x67E00
0x01342C #IDV 0x10 0x10 0x02 0x67E20
0x0134D8 #INSE 0x10 0x10 0x02 0x67E40
0x0134E6 #APPD 0x10 0x10 0x02 0x67E60
0x013500 #REMV 0x10 0x10 0x02 0x67E80
0x013596 #ERET 0x10 0x10 0x02 0x67EA0
0x0135A8 #XRET 0x10 0x10 0x02 0x67EC0
0x0135B6 #PRERR 0x10 0x10 0x02 0x67EE0
0x0136EE MON64 0x10 0x10 0x02 0x67F00
0x01370C MON65 0x10 0x10 0x02 0x67F20
0x013710 #QUIT 0x10 0x10 0x02 0x67F40
0x013710 MON0 0x10 0x10 0x02 0x67F60
0x013714 MON1 0x10 0x10 0x02 0x67F80
0x013748 MON2 0x10 0x10 0x02 0x67FA0
0x018000 RCVRING 0x16 0x00 0x02 0x67FC0
0x018408 XMTRING 0x16 0x00 0x02 0x67FE0
0x018810 LANCEINITB 0x16 0x10 0x02 0x68000
0x018834 LNMASPCOMM 0x16 0x10 0x02 0x68020
0x018848 LNMASPDATA 0x16 0x00 0x02 0x68040
0x01885E LNMAPHYSIC 0x16 0x00 0x02 0x68060
0x018864 LNMAALIVE 0x16 0x00 0x02 0x68080
0x018866 LNMAIOACTI 0x16 0x00 0x02 0x680A0
0x018868 LNMAAUTORE 0x16 0x00 0x02 0x680C0
0x01886A LNMAHWERRO 0x16 0x00 0x02 0x680E0
0x01886E LNMAHWINFO 0x16 0x00 0x02 0x68100
0x018872 LNMAFTERRO 0x16 0x00 0x02 0x68120
0x018876 LNMAFTINFO 0x16 0x00 0x02 0x68140
0x01887A LNMAFTHAND 0x16 0x00 0x02 0x68160
0x01887C LNMAFTEVEN 0x16 0x00 0x02 0x68180
0x01888C LNMASTATIS 0x16 0x00 0x02 0x681A0
0x018A34 POSKPATTER 0x16 0x00 0x02 0x681C0
0x018A38 POSKRG100T 0x16 0x00 0x02 0x681E0
0x018A3C POSKRGPIOC 0x16 0x00 0x02 0x68200
0x018A40 POSKCONFIG 0x16 0x00 0x02 0x68220
0x018A44 POMNSTACK 0x16 0x00 0x02 0x68240
0x019BBA POMNON 0x16 0x00 0x02 0x68260
0x019BBC POMNSTATUS 0x16 0x00 0x02 0x68280
0x01A258 POGDSTATUS 0x16 0x00 0x02 0x682A0
0x01A268 LNCNSPCOMM 0x16 0x00 0x02 0x682C0
0x01A27C LNCNSPDATA 0x16 0x00 0x02 0x682E0
0x01A2B0 NEWCSRQCMD 0x16 0x00 0x02 0x68300
0x01A2B4 NEWNLRSCMD 0x16 0x00 0x02 0x68320
0x01A2B8 NEWNLRSDAT 0x16 0x00 0x02 0x68340
0x01A2BC NEWMARQDAT 0x16 0x00 0x02 0x68360
0x01A2C0 QSERVERRBR 0x16 0x00 0x02 0x68380
0x01A2C4 QDATAFORSE 0x16 0x00 0x02 0x683A0
0x01A2C8 RETRYQCMD 0x16 0x00 0x02 0x683C0
0x01A2CC RETRYQDATA 0x16 0x00 0x02 0x683E0
0x01A2D2 QRETRANSMI 0x16 0x00 0x02 0x68400
0x01AA9A QFREECONN 0x16 0x00 0x02 0x68420
0x01AA9E QACTIVECON 0x16 0x00 0x02 0x68440
0x01AAA2 QWORKCONN 0x16 0x00 0x02 0x68460
0x01AAA6 QFORRBCMD 0x16 0x00 0x02 0x68480
0x01B22A QFREEXTRB 0x16 0x00 0x02 0x684A0
0x01CF2E QFREERBRCV 0x16 0x00 0x02 0x684C0
0x01D0EA QFREECOBF 0x16 0x00 0x02 0x684E0
0x01D10A QFREERBCMD 0x16 0x00 0x02 0x68500
0x01D10E DELTARETRA 0x16 0x00 0x02 0x68520
0x01E16C XGATEVIAPO 0x16 0x00 0x02 0x68540
0x01E1CA POCSINTERN 0x16 0x10 0x02 0x68560
0x01E1DA POCSSYSTEM 0x16 0x10 0x02 0x68580
0x01E1DC POCSMXPDUS 0x16 0x10 0x02 0x685A0
0x01E1E6 POCSSPCOMM 0x16 0x10 0x02 0x685C0
0x01E1FA NEWCSRSCMD 0x16 0x10 0x02 0x685E0
0x01E1FE NEWNLRQCMD 0x16 0x10 0x02 0x68600
0x01E202 NEWNLRQDAT 0x16 0x10 0x02 0x68620
0x01E20E XGATEMSGSW 0x16 0x10 0x02 0x68640
0x01E224 XGATE 0x16 0x00 0x02 0x68660
0x01E22A QFREEXGATE 0x16 0x10 0x02 0x68680
0x01E232 QACTIVEDES 0x16 0x10 0x02 0x686A0
0x02AB5E POCSTRACEB 0x16 0x10 0x02 0x686C0
0x02D334 POGDNUMBER 0x16 0x10 0x02 0x686E0
0x02D338 POGDPROCES 0x16 0x10 0x02 0x68700
0x02D350 POCONFIGUR 0x16 0x10 0x02 0x68720
0x02D354 PODIRECTOR 0x16 0x10 0x02 0x68740
0x02D36E PONAPOOL 0x16 0x10 0x02 0x68760
0x02D472 POPIOCPORT 0x16 0x10 0x02 0x68780
0x02D48C PORTPIOCPO 0x16 0x10 0x02 0x687A0
0x02D4F4 PO100PORTS 0x16 0x10 0x02 0x687C0
0x02D50E PORT100POO 0x16 0x10 0x02 0x687E0
0x02D966 PO100MESSA 0x16 0x10 0x02 0x68800
0x02D980 PO100MSGTY 0x16 0x10 0x02 0x68820
0x02D9CE POMS100POO 0x16 0x10 0x02 0x68840
0x02DEFC POMS100BUF 0x16 0x10 0x02 0x68860
0x036368 ENMANUMBUF 0x16 0x10 0x02 0x68880
0x03636C ENMABUFFER 0x16 0x10 0x02 0x688A0
0x065FF4 XMFSTACK 0x16 0x00 0x02 0x688C0
0x066318 POMNERRORQ 0x16 0x10 0x02 0x688E0
0x06631C POMNFATALQ 0x16 0x10 0x02 0x68900
0x066320 POMNWAITQU 0x16 0x10 0x02 0x68920
0x066324 POMNLOCK 0x16 0x10 0x02 0x68940
0x066326 POMNEVHAND 0x16 0x10 0x02 0x68960
0x066328 POMNEVERRO 0x16 0x10 0x02 0x68980
0x06632C POMNMISSED 0x16 0x10 0x02 0x689A0
0x0663DC DB_INFO 0x16 0x10 0xff 0x689E0
0x0663DC USERDATA05 0x16 0x10 0xff 0x689C0
0x8002784 END_PIOCOS 0x01 0x10 0x02 u 0x664E0
0x80027AC BUFFER_END 0x05 0x10 0x02 u 0x66480
0x80027BE BUFFER_STA 0x05 0x10 0x02 u 0x66500
0x8002856 PIUSERMAIN 0x01 0x10 0x02 u 0x663E0
0x80035CA BUFFER_STA 0x05 0x10 0x02 u 0x66520
0x80035FC BUFFER_END 0x05 0x10 0x02 u 0x664A0

Alphabetical index

Name Address Seg Blk
#APPD 0x0134E6 0x10
#BCPC 0x013148 0x10
#ERET 0x013596 0x10
#ERROR 0x012FA6 0x10
#GETNO 0x01302A 0x10
#IDV 0x01342C 0x10
#IMOD 0x01310C 0x10
#IMU 0x0133E6 0x10
#INBY 0x01249A 0x10
#INBYT 0x0130CC 0x10
#INSE 0x0134D8 0x10
#MOVE 0x013286 0x10
#OUTBYT 0x01309E 0x10
#PRERR 0x0135B6 0x10
#QUIT 0x013710 0x10
#REMV 0x013500 0x10
#SPASI 0x012ED8 0x10
#UTBY 0x012644 0x10
#UTI4 0x01289E 0x10
#XRET 0x0135A8 0x10
ANALYZEEVE 0x0073A0 0x10
ASRCONNECT 0x004D66 0x10
AUTO_START 0x007E0E 0x10
BUFFER_END 0x001A00 0x16
BUFFER_END 0x80027AC 0x05 u
BUFFER_END 0x80035FC 0x05 u
BUFFER_STA 0x0012F4 0x16
BUFFER_STA 0x80027BE 0x05 u
BUFFER_STA 0x80035CA 0x05 u
CMDSERVICE 0x00659C 0x10
CONNECTERR 0x007412 0x10
COPY 0x00BCDE 0x10
CSEVENTS 0x00E24E 0x10
DATASERVIC 0x006ACA 0x10
DB_INFO 0x0663DC 0x16
DELTARETRA 0x01D10E 0x16
END_FREE 0x001A00 0x16
END_FREE 0x001A00 0x26 u
END_PIOCOS 0x004660 0x10
END_PIOCOS 0x8002784 0x01 u
END_SYSTEM 0x004660 0x10
END_SYSTEM 0x004660 0x20 u
ENMABUFFER 0x03636C 0x16
ENMANUMBUF 0x036368 0x16
FATALERROR 0x004C26 0x10
GETALLERRO 0x0072CA 0x10
HARDWAREER 0x0058E0 0x10
INITERRORS 0x007528 0x10
INITLANCE 0x0048EA 0x10
INITRESOUR 0x007776 0x10
INITSUPERK 0x0076C4 0x10
INTLANCE 0x0047F8 0x10
INTPROTECT 0x00485A 0x10
IOCOMPLETI 0x0064C4 0x10
LANCEINITB 0x018810 0x16
LNCNEVENTS 0x00B1EE 0x10
LNCNINIT 0x00B46A 0x10
LNCNSPCOMM 0x01A268 0x16
LNCNSPDATA 0x01A27C 0x16
LNINHEXMAA 0x00F182 0x10
LNMAALIVE 0x018864 0x16
LNMAAUTORE 0x018868 0x16
LNMAEVENTS 0x006DA8 0x10
LNMAFTERRO 0x018872 0x16
LNMAFTEVEN 0x01887C 0x16
LNMAFTHAND 0x01887A 0x16
LNMAFTINFO 0x018876 0x16
LNMAHWERRO 0x01886A 0x16
LNMAHWINFO 0x01886E 0x16
LNMAINIT 0x006EAA 0x10
LNMAIOACTI 0x018866 0x16
LNMAPHYSIC 0x01885E 0x16
LNMASPCOMM 0x018834 0x16
LNMASPDATA 0x018848 0x16
LNMASTATIS 0x01888C 0x16
LNNDFROMMA 0x00F0AE 0x10
LNNDTOMAAP 0x00F05A 0x10
LNOUTHEXMA 0x00F316 0x10
LNPRINTMAS 0x00F4A2 0x10
MON0 0x013710 0x10
MON1 0x013714 0x10
MON2 0x013748 0x10
MON64 0x0136EE 0x10
MON65 0x01370C 0x10
ND100_CPU 0x00064E 0x16
ND100_CPU 0x00064E 0x26 u
NEWCSRQCMD 0x01A2B0 0x16
NEWCSRSCMD 0x01E1FA 0x16
NEWMARQDAT 0x01A2BC 0x16
NEWNLRQCMD 0x01E1FE 0x16
NEWNLRQDAT 0x01E202 0x16
NEWNLRSCMD 0x01A2B4 0x16
NEWNLRSDAT 0x01A2B8 0x16
NIL 0x000000 0x16
NONE_0 0x000000 0x11
NONE_0 0x000000 0x01 u
NONE_1 0x000000 0x01 u
NONE_1 0x000000 0x11
NONE_2 0x000000 0x11
NONE_3 0x000000 0x11
PIOC_NUMBE 0x00064C 0x26 u
PIOC_NUMBE 0x00064C 0x16
PIOCOS 0x01222E 0x10
PIUSERMAIN 0x007E0E 0x10
PIUSERMAIN 0x8002856 0x01 u
PO100MESSA 0x02D966 0x16
PO100MSGTY 0x02D980 0x16
PO100PORTS 0x02D4F4 0x16
PO32TOSTRI 0x012258 0x10
POCONFIGUR 0x02D350 0x16
POCSINTERN 0x01E1CA 0x16
POCSMXPDUS 0x01E1DC 0x16
POCSPROCES 0x00E380 0x10
POCSSPCOMM 0x01E1E6 0x16
POCSSYSTEM 0x01E1DA 0x16
POCSTRACEB 0x02AB5E 0x16
PODIRECTOR 0x02D354 0x16
POGDNUMBER 0x02D334 0x16
POGDPROCES 0x02D338 0x16
POGDSTATUS 0x01A258 0x16
POLKLOCK 0x012168 0x10
POLKUNLOCK 0x012212 0x10
POMNERHAND 0x00704A 0x10
POMNERRORQ 0x066318 0x16
POMNEVERRO 0x066328 0x16
POMNEVHAND 0x066326 0x16
POMNFATALQ 0x06631C 0x16
POMNLOCK 0x066324 0x16
POMNMISSED 0x06632C 0x16
POMNON 0x019BBA 0x16
POMNPROCES 0x007BA2 0x10
POMNREPORT 0x011F78 0x10
POMNSTACK 0x018A44 0x16
POMNSTATUS 0x019BBC 0x16
POMNWAITQU 0x066320 0x16
POMS100BUF 0x02DEFC 0x16
POMS100POO 0x02D9CE 0x16
POMSGETMES 0x00EF68 0x10
PONALOOKUP 0x00EE48 0x10
PONAPOOL 0x02D36E 0x16
PONAREGIST 0x00ED10 0x10
POPIOCPORT 0x02D472 0x16
PORT100POO 0x02D50E 0x16
PORTCONNEC 0x00E940 0x10
PORTCREATE 0x00E73C 0x10
PORTNAME 0x00E8F4 0x10
PORTPIOCPO 0x02D48C 0x16
PORTRECEIV 0x00E994 0x10
PORTSEND 0x00EAA6 0x10
POSIAPPEND 0x011DC4 0x10
POSIGETALL 0x01199E 0x10
POSIGETNEX 0x0118EA 0x10
POSIINITIA 0x011732 0x10
POSIREMOVE 0x011EF2 0x10
POSIRETURN 0x011C66 0x10
POSISTART 0x01179C 0x10
POSISTOP 0x01183C 0x10
POSKCONFIG 0x018A40 0x16
POSKPATTER 0x018A34 0x16
POSKRG100T 0x018A38 0x16
POSKRGPIOC 0x018A3C 0x16
POSPAPPEND 0x011CD8 0x10
POSPGETALL 0x01192A 0x10
POSPGETNEX 0x01186C 0x10
POSPINITIA 0x0116E4 0x10
POSPREMOVE 0x011E2A 0x10
POSPRETURN 0x011A76 0x10
POSPSTART 0x01176A 0x10
POSPSTOP 0x0117CE 0x10
POWAITFORL 0x00E6B0 0x10
PROCESSXGA 0x00D1FC 0x10
PROCESSXMS 0x00D4C0 0x10
PROCESSXRO 0x00CD4A 0x10
QACTIVECON 0x01AA9E 0x16
QACTIVEDES 0x01E232 0x16
QDATAFORSE 0x01A2C4 0x16
QFORRBCMD 0x01AAA6 0x16
QFREECOBF 0x01D0EA 0x16
QFREECONN 0x01AA9A 0x16
QFREERBCMD 0x01D10A 0x16
QFREERBRCV 0x01CF2E 0x16
QFREEXGATE 0x01E22A 0x16
QFREEXTRB 0x01B22A 0x16
QRETRANSMI 0x01A2D2 0x16
QSERVERRBR 0x01A2C0 0x16
QWORKCONN 0x01AAA2 0x16
RCVCOMPLET 0x005C42 0x10
RCVRING 0x018000 0x16
RCVRINGAPP 0x005B60 0x10
REALTIME 0x000FC2 0x26 u
REALTIME 0x000FC2 0x16
RECEIVEREA 0x00BF6A 0x10
REINITRING 0x005722 0x10
RETRYQCMD 0x01A2C8 0x16
RETRYQDATA 0x01A2CC 0x16
SENDERROR 0x0070CC 0x10
START_FREE 0x0012F4 0x26 u
START_FREE 0x0012F4 0x16
STARTIO 0x00487A 0x10
STARTMA 0x005850 0x10
STOPMA 0x005880 0x10
USERDATA05 0x0663DC 0x16
WAIT 0x004E42 0x10
WATCHDOGDE 0x005AC6 0x10
XGATE 0x01E224 0x16
XGATEMSGSW 0x01E20E 0x16
XGATEVIAPO 0x01E16C 0x16
XMFSTACK 0x065FF4 0x16
XMPBADB 0x0113E2 0x10
XMPBAIN 0x011312 0x10
XMPBAST 0x011502 0x10
XMPBINI 0x011236 0x10
XMPBLENGTH 0x0116C2 0x10
XMPBLET 0x01110A 0x10
XMPBRDY 0x0112B0 0x10
XMPCLNM 0x00FF64 0x10
XMPFALM 0x011010 0x10
XMPFCLS 0x0107CA 0x10
XMPFDCT 0x0110BC 0x10
XMPFDMM 0x010FBA 0x10
XMPFDUM 0x01106E 0x10
XMPFGET 0x010820 0x10
XMPFGST 0x0108D6 0x10
XMPFMST 0x010E32 0x10
XMPFOPN 0x010772 0x10
XMPFP2M 0x010F08 0x10
XMPFPRV 0x010F64 0x10
XMPFPST 0x010DAC 0x10
XMPFRCV 0x010BA6 0x10
XMPFREA 0x010936 0x10
XMPFREL 0x010880 0x10
XMPFRHD 0x010A1E 0x10
XMPFRRE 0x010C4C 0x10
XMPFRRH 0x010D06 0x10
XMPFRTN 0x010B42 0x10
XMPFSCM 0x010EAA 0x10
XMPFSND 0x010AE6 0x10
XMPFWHD 0x010A86 0x10
XMPFWRI 0x0109AA 0x10
XMPINFC 0x010302 0x10
XMPOPCN 0x00FF94 0x10
XMPOPNM 0x00FCC4 0x10
XMPRDHD 0x0105A0 0x10
XMPREAD 0x010478 0x10
XMPROUT 0x010666 0x10
XMPSEND 0x0106F0 0x10
XMPWRHD 0x0105E0 0x10
XMPWRTE 0x01050C 0x10
XMPXETS 0x01164E 0x10
XMPXRTS 0x011682 0x10
XMRECEIVER 0x00BED8 0x10
XMSGIOCGAT 0x00BD32 0x10
XMTCOMPLET 0x0061D2 0x10
XMTRING 0x018408 0x16
XMTRINGAPP 0x006054 0x10

Related: README.md - the rest of the ENCOS firmware reverse engineering. The framing / mode-word analysis that led here is in ..\..\..\..\..\SINTRAN\XMSG\DOC\COSMOS-RE\ETHERNET-II-FEASIBILITY-AND-MODE-WORD-RE-2026-07-25.md.