text:
Last time, I tried to figure out how to enable the bootloader through hardware means, but gave up as I was nervous about poking at the pins too much (having very little hardware experience) and didn't want to damage the mouse further. I decided to go back to reversing things on the software side, in the hopes of gaining some insight that might allow me to find out why my mouse isn't responding to commands.
Trying to manipulate a disassembly in a text editor is exceedingly painful. It's fine if you're just trying to figure out a function or two, but not when you're trying to make sense of 32KB of firmware. This is where interactive tools like IDA come in. You can annotate things as you discover them, and change those annotations when you realise you made a mistake. You can easily see what references a particular register or a particular function.
The bad news: IDA doesn't support this obscure microcontroller architecture. The good news: IDA has a plugin architecture. The other bad news: the SDK is miserable to work with. It's better than nothing, though.
IDA includes Python bindings which make it a little more tolerable. There's bindings to all of the C++ APIs exposed by the SDK to regular old C++ modules/plugins, there's bindings to functions provided by IDC (IDA's built-in scripting language), and there's also some Python-specific wrappers. I generally stick with the C++ APIs because they expose all the functionality (not just a subset of it) and seem to be slightly better documented.
For this particular task, we want a processor module that tells IDA how to decode and analyse Holtek microcontroller code. We might eventually want a loader (that recognises MTP files and loads them into IDA), but we can do without it for now, as we've got a raw dump of the program code and all we need to do is map that into a fixed memory address.
The IDA SDK doesn't include much in the way of documentation. You get a bunch of example modules in C++, a Python template (module/script/proctemplate.py), and a couple of Python example modules for TI MSP430 processors and for EFI bytecode.
I was a fool and tried to look for info online, which confused me further. There's a post on the IDA developers' blog called Scriptable Processor modules which purports to explain the basics and provides some simple example code. This looked very different from what I was seeing in the actual IDA SDK's examples, to the point where there was no possible way that code could work.
I found a few different examples on GitHub and tried to start drafting some code based on the common elements I saw between them. Eventually, I was able to produce something that kind of worked, and I kept on hacking on it.
You can find the resulting processor module in my GitHub repository for this mouse RE project: Treeki/TM155-tools. It's just over 500 lines of code, and a bit dirty, but it works.
The first step is to create a subclass of processor_t and define a bunch of properties inside it. These mostly map directly to fields in the C++ processor_t class, with one big exception - the assembler field is a Python dictionary with items mapping to entries in the C++ asm_t class.
flag = 0 # for now?
Every module must have an ID - third-party modules (like mine!) are obliged to start in the 0x8000 range. Every module has flags that control a wide range of behaviour in the IDA kernel; these include things like "supports 32-bit addressing", "stack grows up", "user can't move segments", "has delayed jumps/calls", "has conditional instructions". I read through the entire list and decided none of them seemed relevant to me.
cnbits and dnbits let you define how many bits are in a byte for code and for data segments, respectively. I picked 16 and 8 to try and match the Holtek MCU's behaviour as closely as possible: the program memory is word-addressable, so we want addresses inside IDA to represent that.
segreg_size and tbyte_size are irrelevant to our processor, as we don't have segment registers or long doubles (apparently tbyte is what IDA calls a long double, internally).
psnames and plnames allow a particular module to support multiple types of processors. We could use this to support the three different variants of this MCU, but let's keep it simple for now and just support one.
assembler contains a whole lot of properties defining what the assembly output looks like in IDA. This is why for some processors you get .word 0x1234 and for some you get DW 1234h. We're not aiming to generate something you can feed straight back into the Holtek assembler, we just want it to be understandable, so there's no need to stress too much about that bit.
The fields starting with reg_ are for configuring registers. This MCU is weird in that almost all of its registers are really just special memory locations; IDA's setup is clearly designed for more common architectures (think, for instance, of how x86 has eax, ebx, ecx, edx, ebp, and so forth). The Holtek MCU only has the accumulator A. Even the venerable 6502 has A, X and Y...!
We have to tell IDA about what instructions we support. Each instruction is assigned an arbitrary ID called the itype; we use the instruc_start and instruc_end fields to tell IDA what number range our instructions fall within, and the instruc list to give it metadata about those instructions. This just includes the instruction name and a 'feature', which is a set of flags defining how the instruction operates.
I build these up using fields located in INSN_DEFS, which is an array I've defined that contains those as well as some other useful properties used by my helper functions inside the module.
Finally, you need to tell IDA about your processor_t subclass. This is simple: define a PROCESSOR_ENTRY function that just returns a new instance of your processor class.
There's a lot of events you can handle inside a processor module, and this happens by implementing methods in your class with specific signatures. Most have names starting with notify_, but not all. There's Python templates for these in the SDK's module/script/proctemplate.py and there's also some information in the event_t enum in include/idp.hpp. For some reason I haven't figured out, there's subtle differences between some names between C++ and Python, like ev_ana_insn becoming notify_ana. I guess you can't make it too easy.
All are optional, with the exception of four: notify_ana decodes and analyses an instruction on its own, notify_emu performs analysis tasks that may involve multiple instructions/addresses, notify_out_insn tells IDA how to display an instruction as a whole, and notify_out_operand tells IDA how to display an instruction operand.
Then, you decode the instruction and put its itype into the itype property, and put details about its operands (if any) into the Op1, Op2, ... fields. Pretty straightforward. If it succeeds, you return the amount of bytes in the instruction. If it fails, you return 0, and IDA refuses to turn that particular instruction into code.
There's not much going on here. For the former, you're passed an outctx_t instance. For the latter, you're passed outctx_t and also op_t (this is the exact same object as insn_t.Op1 and company!). The outctx_t object contains methods that generate the output.
You can output arbitrary text using it, but for IDA to work best, you need to make sure you call the most appropriate methods. If you have an operand containing an immediate value (like mov A, 69), don't just spit out the number, call ctx.out_value(op), and IDA will allow you to change that number to different representations like decimal, hex or even an enum member.
This function receives an insn_t instance; it'll contain the info you generated inside notify_ana. Despite the names, this is really what makes all of the fancy analysis stuff possible. You can get away with leaving it empty and simply returning 1 for an initial draft, which is what I did when I was trying to get notify_ana and notify_out_* right, but you'll definitely need a proper implementation for a usable processor module.
There's one thing I've glossed over so far. With the setup as we've described it so far, we get a single code region (0000 to 3FFF), which is what we map to the MCU's program memory. That only covers half of the story: the MCU also has data memory. Six banks worth of registers and plain old RAM, ranging from 00 to FF in each bank. How do we deal with this?
The answer is to be crafty with segments. IDA has two kinds of addresses: the linear address (this lies within 00000000 to FFFFFFFF for the non-64 variant of IDA) and the virtual address. We've got to use distinct regions of the linear address space for the Program and Data memories, but this doesn't have to be the case for the virtual address space!
Furthermore, we told IDA that bytes inside code sections are 16 bits wide, and that bytes inside data sections are 8 bits wide. We can say whether a particular segment is code or data, so this perfectly replicates the distinction in our MCU where a single address refers to one word in program memory and one byte in data memory.
We should have some code that automatically creates this segment.
This method runs every time a database is opened, thanks to the event handlers. We check to see if a segment called HTRAM exists. If it does, then we record its linear address (this is used in our notify_ana implementation when we decode operands pointing to memory). If it doesn't, then we use IDA's free_chunk function to find some free space in the linear address space, and create an appropriate segment.
This is all we need to have a region for data memory! When we load the firmware code, we end up with the default 'ROM' (program memory) segment at 0000..3FFF, and the data memory segment gets assigned linear addresses 4000..45FF. However, since we told IDA that the base was 4000 (this is what the ram_start >> 4 argument to add_segm_ex does), what we actually see are addresses starting from HTRAM:0000. Perfect.
Most of the first half of each bank is dedicated to registers with fixed locations. We know that [06h] is always going to hold PCL (Program Counter Low) and that [67h] is always USR (USB endpoint accessed detection). With notify_emu setting up our data references using add_dref, IDA automatically recognises them as memory locations, but it doesn't know what they are. Let's fix that.
I created a JSON file containing the short names, long names, bits and applicable banks for every register, based off the HT68FB560.inc file. Inserting them into the database is simple: after we create the HTRAM segment, we can just go and put that stuff in. For good measure, let's name the interrupt vectors too.
This gets us automatic names for each register in every bank. We've added the descriptive names as repeatable comments: this is IDA-speak for "this comment automatically appears everywhere that this register is referenced".
And just like that, there's our switch to bootloader function! Note how every direct use of a register like TBLP and INTC0 is annotated with the full name.
On our wee Holtek chip, setting a bit is as simple as set [9Eh].0. Calling a function if a particular bit is set takes just two instructions: sz [9Eh].0; call myCoolFunction.
With as little RAM as this MCU has, space is at a premium, so packing as much data as you can into memory is vital. Most hardware access also involves working with individual bits in registers, so having an efficient and simple way to do that is highly useful.
Unfortunately, as far as I can tell, there isn't an elegant way in IDA to deal with these. You can create structures which even support concepts like unions, but they don't support bitfields. The type system used by the Hex-Rays Decompiler appears to support them, but we're working with plain old IDA, with an architecture that the decompiler will never, ever support.
I debated for a bit on how to handle these, looking at other example processor modules. The PIC module implements them solely by displaying bits loaded from a .cfg file, but this doesn't allow for customisation in the IDA interface. That approach is fine for hardware registers, but not when you're analysing code that makes heavy use of its own bit-packed variables.
I eventually settled for an approach using IDA's Enums and Netnode systems.
The first portion of this system is simple enough. I have pre-defined names for bits within all the hardware registers where bitwise access makes sense, and I've loaded these in from my JSON file, so I can go ahead and create enums for them when I'm preparing the database, after the HTRAM segment has been created.
Alright, so we've got these. Now, when I see the instruction sz B0_STATUS.0, I can highlight the 0 and press M and select bit_STATUS from the Enums list that comes up, and it'll turn it into sz B0_STATUS.STATUS:C. And if I decide I want to give STATUS:C a better name, like CarryFlag, then I can highlight it and press N and enter a new name, and it'll update everywhere in the disassembly.
But that instruction, sz B0_STATUS.0, is literally pointing to a hardware register that I know has an Enum. Can't I just have the processor module do that every time it sees a write? Yes.
We need to do that inside notify_emu, when we're processing the 'which bit' operand for these instructions. That seems straightforward, we can just look at the target register and figure out if we've created an enum for it. The tricky thing is that we need to store that information in a way that survives IDA being restarted.
We sort of had this issue when we made the HTRAM segment, but it was easy to work past because we could just call get_segm_by_name('HTRAM') and it would give us that segment. Long as the user keeps it named HTRAM, our code will work fine.
We don't want to rely on something as brittle as naming when we want to look up one of over 60 enums. This is where the Netnode system comes into play. It's a part of the IDA SDK designed specifically for this use case: allowing modules and plugins to store extra data. It's used by several other modules in the SDK, so there's plenty of examples, and the documentation inside include/netnode.hpp is also pretty good.
The first step is to create a netnode. We assign it the name $ holtek; starting with $ followed by a space is a requirement specified in the documentation. It's necessary to avoid conflicts with user-defined names in the database, since the netnode system is what IDA uses to store everything in an IDA database.
Each netnode essentially contains 256 arrays, identified by a single character (the 'tag'). We're using the one with tag b to store the enum that's tied to a particular data memory address.
There's a few different storage mechanisms you can use. I picked altval, "a sparse array of 32-bit values". Each enum's ID is a 32-bit value, so this works just fine.
Next, we alter the code that creates our registers. While creating the enums, we stored the enum IDs (the return of add_enum) into the bit_enums dictionary, but didn't actually do anything with the resulting dictionary. This is where we now use it: for each register, if there's a matching enum, we call altset_ea on the netnode (helper) to store that enum ID (bit_enums[offset]) against the register's linear address (ea).
We've got the information in, now to use it. The third and final step ties the whole system together, going into all the processing that occurs inside notify_emu.
# TODO: ignore some like ACC maybe?
First, we make sure we only do this for immediate operands occurring inside an instruction that matches HTOP_BIT. Next, we fetch the data out of the instruction: for an instruction sz [9Fh].5, this would set bit to 5 and enum_addr to the linear address of data memory 0x9F.
Then, we ask the netnode if there's an enum assigned to that particular linear address. If there isn't, then we create one on-the-fly, and stick it into the netnode.
Then, we ask IDA if there is's a value in that enum for that particular bit. If there isn't, then we add one with a default name.
These last two things are the Cool Trick™ that makes this system work for variables as well as the standard pre-defined hardware registers! If we ever see sz [9Fh].5 in the code, then we know that there must be some sort of significance to that bit, so we add it to the enums, turning it into sz [9Fh].b09F:5. Then, once the user thinks they know what [9Fh].5 stores, they can just smash the N key and enter a new name and it'll show up everywhere that addresses [9Fh].5. Amazing.
The last piece of this puzzle is to call op_enum - this is the programmatic equivalent of highlighting the number 5, pressing M and selecting the enum from the list.
I can't "drill down" into the individual bits and see what portions of code reference each one. I can, however, look at the cross-references window for the whole byte. Since the names now show up in the instruction itself, it's incredibly easy to see precisely what is being accessed.
A fairly common pattern when programming for this processor involves jump tables; the low-level equivalent of a 'switch' block. Take the code that handles USB commands, for example. You could implement this as a chain of comparisons - "if cmd is 0 jump to X, if cmd is 1 jump to Y, if cmd is 2 jump to Z, ..." - but it's much easier to use a jump table.
Values of A from 0 to 2 will jump to those conveniently-named labels. If A is 3, we just execute ret and return. If A is higher than 3, we jump into no man's land.
IDA is pretty good at detecting different kinds of jump tables and 'switch' constructs, so I wanted to see if I could take advantage of this and create some nice handling for them.
There's a bunch of functions and structures defined in the SDK for dealing with switch statements. There's an entire page of flags for defining attributes that they can have. I spent a while trying to get this working, and in the end gave up - I got to the point where IDA would detect addm A, PCL and try to construct a switch statement, but rather than treating the table entries as instructions (jmp 04FAh, etc) it would turn the opcode into an invalid address.
I ended up adding a check to notify_emu to detect the addm A, PCL sequence. It knows that the jump table always begins immediately after that instruction. There's an algorithm which tries to guess where the jump table ends, with some simple heuristics.
Once it's figured that out, it goes through every entry and gives it a name based off its index. If that entry is a jump to somewhere else, then that target location gets a name based off its index as well. This gives us verbose but helpful auto-generated names like jtbl_06AA_case_target_0A (that's the handler for command 0xA, reboot to bootloader) and jtbl_0DEF_case_target_00_01 (this one's used for both indices 00 and 01 in a particular jump table).
Finally, to make IDA's analysis work properly, add_cref is used to create a code reference from the addm A, PCL instruction to each jump table entry. Simple, but effective! Here's a couple of snaps of what the result ends up looking like.
There's still things that could be improved in this module, but I think I've reached the point of diminishing returns. One weak spot is that there's no good handling for accessing registers and memory in banks above 0.
Fixing this properly would require more in-depth analysis of the code and trying to keep track of the current state of the BP, MP0 and MP1 registers at a given instruction. So whenever I come across code that deals with it, I have to do a bit of thinking and annotate things manually.
Likewise for table handling, there's no special processing for the TBLP and TBHP registers, or any attempts to create data references when data is read using the tabrd instruction. It's not very heavily used in my mouse's firmware (most of the table access is centralised in certain functions), so I figured the effort involved in implementing that would outweigh the time saving when figuring out that code.
So I've got a nice little IDA module now for disassembling this mouse's firmware. I'm ready to start digging into it and figuring out how it works! First point of call will be the USB data handlers, as I want to look for a way to get it out of this semi-bricked state.

lowercased:
last time, i tried to figure out how to enable the bootloader through hardware means, but gave up as i was nervous about poking at the pins too much (having very little hardware experience) and didn't want to damage the mouse further. i decided to go back to reversing things on the software side, in the hopes of gaining some insight that might allow me to find out why my mouse isn't responding to commands.
trying to manipulate a disassembly in a text editor is exceedingly painful. it's fine if you're just trying to figure out a function or two, but not when you're trying to make sense of 32kb of firmware. this is where interactive tools like ida come in. you can annotate things as you discover them, and change those annotations when you realise you made a mistake. you can easily see what references a particular register or a particular function.
the bad news: ida doesn't support this obscure microcontroller architecture. the good news: ida has a plugin architecture. the other bad news: the sdk is miserable to work with. it's better than nothing, though.
ida includes python bindings which make it a little more tolerable. there's bindings to all of the c++ apis exposed by the sdk to regular old c++ modules/plugins, there's bindings to functions provided by idc (ida's built-in scripting language), and there's also some python-specific wrappers. i generally stick with the c++ apis because they expose all the functionality (not just a subset of it) and seem to be slightly better documented.
for this particular task, we want a processor module that tells ida how to decode and analyse holtek microcontroller code. we might eventually want a loader (that recognises mtp files and loads them into ida), but we can do without it for now, as we've got a raw dump of the program code and all we need to do is map that into a fixed memory address.
the ida sdk doesn't include much in the way of documentation. you get a bunch of example modules in c++, a python template (module/script/proctemplate.py), and a couple of python example modules for ti msp430 processors and for efi bytecode.
i was a fool and tried to look for info online, which confused me further. there's a post on the ida developers' blog called scriptable processor modules which purports to explain the basics and provides some simple example code. this looked very different from what i was seeing in the actual ida sdk's examples, to the point where there was no possible way that code could work.
i found a few different examples on github and tried to start drafting some code based on the common elements i saw between them. eventually, i was able to produce something that kind of worked, and i kept on hacking on it.
you can find the resulting processor module in my github repository for this mouse re project: treeki/tm155-tools. it's just over 500 lines of code, and a bit dirty, but it works.
the first step is to create a subclass of processor_t and define a bunch of properties inside it. these mostly map directly to fields in the c++ processor_t class, with one big exception - the assembler field is a python dictionary with items mapping to entries in the c++ asm_t class.
flag = 0 # for now?
every module must have an id - third-party modules (like mine!) are obliged to start in the 0x8000 range. every module has flags that control a wide range of behaviour in the ida kernel; these include things like "supports 32-bit addressing", "stack grows up", "user can't move segments", "has delayed jumps/calls", "has conditional instructions". i read through the entire list and decided none of them seemed relevant to me.
cnbits and dnbits let you define how many bits are in a byte for code and for data segments, respectively. i picked 16 and 8 to try and match the holtek mcu's behaviour as closely as possible: the program memory is word-addressable, so we want addresses inside ida to represent that.
segreg_size and tbyte_size are irrelevant to our processor, as we don't have segment registers or long doubles (apparently tbyte is what ida calls a long double, internally).
psnames and plnames allow a particular module to support multiple types of processors. we could use this to support the three different variants of this mcu, but let's keep it simple for now and just support one.
assembler contains a whole lot of properties defining what the assembly output looks like in ida. this is why for some processors you get .word 0x1234 and for some you get dw 1234h. we're not aiming to generate something you can feed straight back into the holtek assembler, we just want it to be understandable, so there's no need to stress too much about that bit.
the fields starting with reg_ are for configuring registers. this mcu is weird in that almost all of its registers are really just special memory locations; ida's setup is clearly designed for more common architectures (think, for instance, of how x86 has eax, ebx, ecx, edx, ebp, and so forth). the holtek mcu only has the accumulator a. even the venerable 6502 has a, x and y...!
we have to tell ida about what instructions we support. each instruction is assigned an arbitrary id called the itype; we use the instruc_start and instruc_end fields to tell ida what number range our instructions fall within, and the instruc list to give it metadata about those instructions. this just includes the instruction name and a 'feature', which is a set of flags defining how the instruction operates.
i build these up using fields located in insn_defs, which is an array i've defined that contains those as well as some other useful properties used by my helper functions inside the module.
finally, you need to tell ida about your processor_t subclass. this is simple: define a processor_entry function that just returns a new instance of your processor class.
there's a lot of events you can handle inside a processor module, and this happens by implementing methods in your class with specific signatures. most have names starting with notify_, but not all. there's python templates for these in the sdk's module/script/proctemplate.py and there's also some information in the event_t enum in include/idp.hpp. for some reason i haven't figured out, there's subtle differences between some names between c++ and python, like ev_ana_insn becoming notify_ana. i guess you can't make it too easy.
all are optional, with the exception of four: notify_ana decodes and analyses an instruction on its own, notify_emu performs analysis tasks that may involve multiple instructions/addresses, notify_out_insn tells ida how to display an instruction as a whole, and notify_out_operand tells ida how to display an instruction operand.
then, you decode the instruction and put its itype into the itype property, and put details about its operands (if any) into the op1, op2, ... fields. pretty straightforward. if it succeeds, you return the amount of bytes in the instruction. if it fails, you return 0, and ida refuses to turn that particular instruction into code.
there's not much going on here. for the former, you're passed an outctx_t instance. for the latter, you're passed outctx_t and also op_t (this is the exact same object as insn_t.op1 and company!). the outctx_t object contains methods that generate the output.
you can output arbitrary text using it, but for ida to work best, you need to make sure you call the most appropriate methods. if you have an operand containing an immediate value (like mov a, 69), don't just spit out the number, call ctx.out_value(op), and ida will allow you to change that number to different representations like decimal, hex or even an enum member.
this function receives an insn_t instance; it'll contain the info you generated inside notify_ana. despite the names, this is really what makes all of the fancy analysis stuff possible. you can get away with leaving it empty and simply returning 1 for an initial draft, which is what i did when i was trying to get notify_ana and notify_out_* right, but you'll definitely need a proper implementation for a usable processor module.
there's one thing i've glossed over so far. with the setup as we've described it so far, we get a single code region (0000 to 3fff), which is what we map to the mcu's program memory. that only covers half of the story: the mcu also has data memory. six banks worth of registers and plain old ram, ranging from 00 to ff in each bank. how do we deal with this?
the answer is to be crafty with segments. ida has two kinds of addresses: the linear address (this lies within 00000000 to ffffffff for the non-64 variant of ida) and the virtual address. we've got to use distinct regions of the linear address space for the program and data memories, but this doesn't have to be the case for the virtual address space!
furthermore, we told ida that bytes inside code sections are 16 bits wide, and that bytes inside data sections are 8 bits wide. we can say whether a particular segment is code or data, so this perfectly replicates the distinction in our mcu where a single address refers to one word in program memory and one byte in data memory.
we should have some code that automatically creates this segment.
this method runs every time a database is opened, thanks to the event handlers. we check to see if a segment called htram exists. if it does, then we record its linear address (this is used in our notify_ana implementation when we decode operands pointing to memory). if it doesn't, then we use ida's free_chunk function to find some free space in the linear address space, and create an appropriate segment.
this is all we need to have a region for data memory! when we load the firmware code, we end up with the default 'rom' (program memory) segment at 0000..3fff, and the data memory segment gets assigned linear addresses 4000..45ff. however, since we told ida that the base was 4000 (this is what the ram_start >> 4 argument to add_segm_ex does), what we actually see are addresses starting from htram:0000. perfect.
most of the first half of each bank is dedicated to registers with fixed locations. we know that [06h] is always going to hold pcl (program counter low) and that [67h] is always usr (usb endpoint accessed detection). with notify_emu setting up our data references using add_dref, ida automatically recognises them as memory locations, but it doesn't know what they are. let's fix that.
i created a json file containing the short names, long names, bits and applicable banks for every register, based off the ht68fb560.inc file. inserting them into the database is simple: after we create the htram segment, we can just go and put that stuff in. for good measure, let's name the interrupt vectors too.
this gets us automatic names for each register in every bank. we've added the descriptive names as repeatable comments: this is ida-speak for "this comment automatically appears everywhere that this register is referenced".
and just like that, there's our switch to bootloader function! note how every direct use of a register like tblp and intc0 is annotated with the full name.
on our wee holtek chip, setting a bit is as simple as set [9eh].0. calling a function if a particular bit is set takes just two instructions: sz [9eh].0; call mycoolfunction.
with as little ram as this mcu has, space is at a premium, so packing as much data as you can into memory is vital. most hardware access also involves working with individual bits in registers, so having an efficient and simple way to do that is highly useful.
unfortunately, as far as i can tell, there isn't an elegant way in ida to deal with these. you can create structures which even support concepts like unions, but they don't support bitfields. the type system used by the hex-rays decompiler appears to support them, but we're working with plain old ida, with an architecture that the decompiler will never, ever support.
i debated for a bit on how to handle these, looking at other example processor modules. the pic module implements them solely by displaying bits loaded from a .cfg file, but this doesn't allow for customisation in the ida interface. that approach is fine for hardware registers, but not when you're analysing code that makes heavy use of its own bit-packed variables.
i eventually settled for an approach using ida's enums and netnode systems.
the first portion of this system is simple enough. i have pre-defined names for bits within all the hardware registers where bitwise access makes sense, and i've loaded these in from my json file, so i can go ahead and create enums for them when i'm preparing the database, after the htram segment has been created.
alright, so we've got these. now, when i see the instruction sz b0_status.0, i can highlight the 0 and press m and select bit_status from the enums list that comes up, and it'll turn it into sz b0_status.status:c. and if i decide i want to give status:c a better name, like carryflag, then i can highlight it and press n and enter a new name, and it'll update everywhere in the disassembly.
but that instruction, sz b0_status.0, is literally pointing to a hardware register that i know has an enum. can't i just have the processor module do that every time it sees a write? yes.
we need to do that inside notify_emu, when we're processing the 'which bit' operand for these instructions. that seems straightforward, we can just look at the target register and figure out if we've created an enum for it. the tricky thing is that we need to store that information in a way that survives ida being restarted.
we sort of had this issue when we made the htram segment, but it was easy to work past because we could just call get_segm_by_name('htram') and it would give us that segment. long as the user keeps it named htram, our code will work fine.
we don't want to rely on something as brittle as naming when we want to look up one of over 60 enums. this is where the netnode system comes into play. it's a part of the ida sdk designed specifically for this use case: allowing modules and plugins to store extra data. it's used by several other modules in the sdk, so there's plenty of examples, and the documentation inside include/netnode.hpp is also pretty good.
the first step is to create a netnode. we assign it the name $ holtek; starting with $ followed by a space is a requirement specified in the documentation. it's necessary to avoid conflicts with user-defined names in the database, since the netnode system is what ida uses to store everything in an ida database.
each netnode essentially contains 256 arrays, identified by a single character (the 'tag'). we're using the one with tag b to store the enum that's tied to a particular data memory address.
there's a few different storage mechanisms you can use. i picked altval, "a sparse array of 32-bit values". each enum's id is a 32-bit value, so this works just fine.
next, we alter the code that creates our registers. while creating the enums, we stored the enum ids (the return of add_enum) into the bit_enums dictionary, but didn't actually do anything with the resulting dictionary. this is where we now use it: for each register, if there's a matching enum, we call altset_ea on the netnode (helper) to store that enum id (bit_enums[offset]) against the register's linear address (ea).
we've got the information in, now to use it. the third and final step ties the whole system together, going into all the processing that occurs inside notify_emu.
# todo: ignore some like acc maybe?
first, we make sure we only do this for immediate operands occurring inside an instruction that matches htop_bit. next, we fetch the data out of the instruction: for an instruction sz [9fh].5, this would set bit to 5 and enum_addr to the linear address of data memory 0x9f.
then, we ask the netnode if there's an enum assigned to that particular linear address. if there isn't, then we create one on-the-fly, and stick it into the netnode.
then, we ask ida if there is's a value in that enum for that particular bit. if there isn't, then we add one with a default name.
these last two things are the cool trick™ that makes this system work for variables as well as the standard pre-defined hardware registers! if we ever see sz [9fh].5 in the code, then we know that there must be some sort of significance to that bit, so we add it to the enums, turning it into sz [9fh].b09f:5. then, once the user thinks they know what [9fh].5 stores, they can just smash the n key and enter a new name and it'll show up everywhere that addresses [9fh].5. amazing.
the last piece of this puzzle is to call op_enum - this is the programmatic equivalent of highlighting the number 5, pressing m and selecting the enum from the list.
i can't "drill down" into the individual bits and see what portions of code reference each one. i can, however, look at the cross-references window for the whole byte. since the names now show up in the instruction itself, it's incredibly easy to see precisely what is being accessed.
a fairly common pattern when programming for this processor involves jump tables; the low-level equivalent of a 'switch' block. take the code that handles usb commands, for example. you could implement this as a chain of comparisons - "if cmd is 0 jump to x, if cmd is 1 jump to y, if cmd is 2 jump to z, ..." - but it's much easier to use a jump table.
values of a from 0 to 2 will jump to those conveniently-named labels. if a is 3, we just execute ret and return. if a is higher than 3, we jump into no man's land.
ida is pretty good at detecting different kinds of jump tables and 'switch' constructs, so i wanted to see if i could take advantage of this and create some nice handling for them.
there's a bunch of functions and structures defined in the sdk for dealing with switch statements. there's an entire page of flags for defining attributes that they can have. i spent a while trying to get this working, and in the end gave up - i got to the point where ida would detect addm a, pcl and try to construct a switch statement, but rather than treating the table entries as instructions (jmp 04fah, etc) it would turn the opcode into an invalid address.
i ended up adding a check to notify_emu to detect the addm a, pcl sequence. it knows that the jump table always begins immediately after that instruction. there's an algorithm which tries to guess where the jump table ends, with some simple heuristics.
once it's figured that out, it goes through every entry and gives it a name based off its index. if that entry is a jump to somewhere else, then that target location gets a name based off its index as well. this gives us verbose but helpful auto-generated names like jtbl_06aa_case_target_0a (that's the handler for command 0xa, reboot to bootloader) and jtbl_0def_case_target_00_01 (this one's used for both indices 00 and 01 in a particular jump table).
finally, to make ida's analysis work properly, add_cref is used to create a code reference from the addm a, pcl instruction to each jump table entry. simple, but effective! here's a couple of snaps of what the result ends up looking like.
there's still things that could be improved in this module, but i think i've reached the point of diminishing returns. one weak spot is that there's no good handling for accessing registers and memory in banks above 0.
fixing this properly would require more in-depth analysis of the code and trying to keep track of the current state of the bp, mp0 and mp1 registers at a given instruction. so whenever i come across code that deals with it, i have to do a bit of thinking and annotate things manually.
likewise for table handling, there's no special processing for the tblp and tbhp registers, or any attempts to create data references when data is read using the tabrd instruction. it's not very heavily used in my mouse's firmware (most of the table access is centralised in certain functions), so i figured the effort involved in implementing that would outweigh the time saving when figuring out that code.
so i've got a nice little ida module now for disassembling this mouse's firmware. i'm ready to start digging into it and figuring out how it works! first point of call will be the usb data handlers, as i want to look for a way to get it out of this semi-bricked state.


text:
. launched a series of small films on youtube to engage people and alert them to renew their insurance. The campaign was created in collaboration with BBH India a digital innovation on Youtube. The.
No sign of Julie Bishop’s getaway car, never mind a sprung vault at the bank. But for its political effect to be felt in this age of birtherism and empty sleight, the facts don’t matter. Miranda Devin.
The link between a car maker and football club may not be obvious straight. has stepped down as the pizza group’s chairman after it was reported that he used the N-word in a conference call. The 56.
This year, barring a couple, no heavyweight agency is participating in Goafest. ET Now’s Sonali Krishna holds this special panel discussion to debate the reasons thereof.
The Government has set up the pre-budget period by nailing two big social reforms to the mast: a big increase in schools funding and the National Disabilities Insurance Scheme. and they think to th.
Publicis Groupe is organized across four Solutions hubs: "Publicis Communications" (Publicis Worldwide with MSL, Saatchi & Saatchi, Leo Burnett, BBH, and Prodigious), "Publicis. Bankimia (Spain), B.
ASCI has been built on the foundation of self-regulation." Members of the board includes TGBL Director Harish Bhat, BBH Communications India Managing Partner Subhash Kamath, HUL Executive Director & V.

lowercased:
. launched a series of small films on youtube to engage people and alert them to renew their insurance. the campaign was created in collaboration with bbh india a digital innovation on youtube. the.
no sign of julie bishop’s getaway car, never mind a sprung vault at the bank. but for its political effect to be felt in this age of birtherism and empty sleight, the facts don’t matter. miranda devin.
the link between a car maker and football club may not be obvious straight. has stepped down as the pizza group’s chairman after it was reported that he used the n-word in a conference call. the 56.
this year, barring a couple, no heavyweight agency is participating in goafest. et now’s sonali krishna holds this special panel discussion to debate the reasons thereof.
the government has set up the pre-budget period by nailing two big social reforms to the mast: a big increase in schools funding and the national disabilities insurance scheme. and they think to th.
publicis groupe is organized across four solutions hubs: "publicis communications" (publicis worldwide with msl, saatchi & saatchi, leo burnett, bbh, and prodigious), "publicis. bankimia (spain), b.
asci has been built on the foundation of self-regulation." members of the board includes tgbl director harish bhat, bbh communications india managing partner subhash kamath, hul executive director & v.


text:
Gabriel Germain Boffrand was a French architect and interior decorator whose mastery of the new Louis XV or rococo style widely influenced 18th-century architecture in France and abroad.
Gabriel Germain codified and disseminated the supple rococo style which borrowed, in miniature scale, more from the Italian baroque of Francesco Borromini and Guarino Guarini than from the stringent academic classicism favored in France since the Renaissance. Boffrand's book Livre d'architecture (1745) indicates that he was aware of his role as mediator of the golden mean between reason and fantasy.
Through loss of documentation and the demolition of most of the palaces and town houses Boffrand built in Paris and in the province of Lorraine, relatively little evidence of his talents subsists. He is said to have begun his artistic training under the sculptor Francois Girardon, but there is proof that Boffrand worked for the first architect of the king, Jules Hardouin Mansart, from 1686 to 1691 and during 1693-1694. From 1694 to 1709 Boffrand worked on his own in Paris, Lorraine, and the Netherlands, building and remodeling private houses and small palaces. In 1709 he became, under the sponsorship of the new first architect, Robert de Cotte, a member of the Royal Academy and architect of the superintendence of buildings. Boffrand's remodeling of the Petit-Luxembourg is the principal surviving source of numerous examples of his interior designs, and it supplies clues for other attributions to him.
Between 1711 and 1715 Boffrand worked in Lorraine as first architect to Duke Leopold, building palaces at Nancy and Luneville and the chateau La Malgrange, all destroyed. Two Parisian houses demonstrate Boffrand's style during the Regency period: the Hotel de Villars (1713 and 1717) and the Hotel de Parabere (1718-1720). In 1723 Balthasar Neumann, architect to the prince-bishop of Wurzburg, brought his plans for the new Residenz to Paris for editing by De Cotte and Boffrand; the latter visited the site at Wurzburg the next year. In 1736 Boffrand undertook the interior design of the Hotel Soubise in Paris, his last and most notable work. The oval salon is the outstanding creation of the rococo style.
Boffrand was a master of integrating convex and concave spatial solids and rectilinear and curvilinear planes. His signal credit as an architect was in having concretized the evolution of the sometimes overly mannered and occasionally chaotic style called the rococo.
Fiske Kimball, The Creation of the Rococo (1943), weaves Boffrand into the fabric of the 50-year evolution of the rococo style but underrates his importance as an original contributor. A valuable background study is Germain Bazin, Baroque and Rococo (trans. 1964).

lowercased:
gabriel germain boffrand was a french architect and interior decorator whose mastery of the new louis xv or rococo style widely influenced 18th-century architecture in france and abroad.
gabriel germain codified and disseminated the supple rococo style which borrowed, in miniature scale, more from the italian baroque of francesco borromini and guarino guarini than from the stringent academic classicism favored in france since the renaissance. boffrand's book livre d'architecture (1745) indicates that he was aware of his role as mediator of the golden mean between reason and fantasy.
through loss of documentation and the demolition of most of the palaces and town houses boffrand built in paris and in the province of lorraine, relatively little evidence of his talents subsists. he is said to have begun his artistic training under the sculptor francois girardon, but there is proof that boffrand worked for the first architect of the king, jules hardouin mansart, from 1686 to 1691 and during 1693-1694. from 1694 to 1709 boffrand worked on his own in paris, lorraine, and the netherlands, building and remodeling private houses and small palaces. in 1709 he became, under the sponsorship of the new first architect, robert de cotte, a member of the royal academy and architect of the superintendence of buildings. boffrand's remodeling of the petit-luxembourg is the principal surviving source of numerous examples of his interior designs, and it supplies clues for other attributions to him.
between 1711 and 1715 boffrand worked in lorraine as first architect to duke leopold, building palaces at nancy and luneville and the chateau la malgrange, all destroyed. two parisian houses demonstrate boffrand's style during the regency period: the hotel de villars (1713 and 1717) and the hotel de parabere (1718-1720). in 1723 balthasar neumann, architect to the prince-bishop of wurzburg, brought his plans for the new residenz to paris for editing by de cotte and boffrand; the latter visited the site at wurzburg the next year. in 1736 boffrand undertook the interior design of the hotel soubise in paris, his last and most notable work. the oval salon is the outstanding creation of the rococo style.
boffrand was a master of integrating convex and concave spatial solids and rectilinear and curvilinear planes. his signal credit as an architect was in having concretized the evolution of the sometimes overly mannered and occasionally chaotic style called the rococo.
fiske kimball, the creation of the rococo (1943), weaves boffrand into the fabric of the 50-year evolution of the rococo style but underrates his importance as an original contributor. a valuable background study is germain bazin, baroque and rococo (trans. 1964).


text:
Fantastic service and will be recommending to everyone.
Another perfect t-shirt print from StreetShirts. With a fast delivery as well...this is an ideal service for planning Christmas presents! Thanks again StreetShirts!

lowercased:
fantastic service and will be recommending to everyone.
another perfect t-shirt print from streetshirts. with a fast delivery as well...this is an ideal service for planning christmas presents! thanks again streetshirts!


text:
Colebrook Sturrock are driven by doing the best for our customers whether they are buying, selling, renting or letting a property, so what they say matters above all else.
We use a company called Referenceline to gather feedback from our clients. We use an outside company to ensure that all of the feedback we receive is independent.
Referenceline's reports for the Ombudsman for Estate Agents and the British Association of Removers are accepted by the Office of Fair Trading as part of the monitoring for their Consumer Codes Approval Scheme. They are also members of Trading Standards' Buy with Confidence scheme.
One of the things we love about Referenceline is that they operate an "all or nothing" policy so we get (and you can see) the bad with the good. If we have an unhappy client, we want to know about it so we can do everything to make sure we address any problems and constantly improve our service.

lowercased:
colebrook sturrock are driven by doing the best for our customers whether they are buying, selling, renting or letting a property, so what they say matters above all else.
we use a company called referenceline to gather feedback from our clients. we use an outside company to ensure that all of the feedback we receive is independent.
referenceline's reports for the ombudsman for estate agents and the british association of removers are accepted by the office of fair trading as part of the monitoring for their consumer codes approval scheme. they are also members of trading standards' buy with confidence scheme.
one of the things we love about referenceline is that they operate an "all or nothing" policy so we get (and you can see) the bad with the good. if we have an unhappy client, we want to know about it so we can do everything to make sure we address any problems and constantly improve our service.


text: Since Harald and I are currently in the midst of some redecorating for Spring I am so excited to be doing my first mattress review for the revamp! Truth be told my whole life I have always struggled finding the right mattress for my plus size stature. All of my mattresses throughout my life have always been too soft and would always quickly wear out specifically at the point where I sleep. Specifically this last year I noticed I was having a lot more back and hip problems. Living in NYC and freelancing from home there I tend to use my bed a lot more then people working a 9-5pm job. I had seen a review of the brand on my good friend Ashley Nell Tipton page I knew I needed to try it out!The order to delivery process for my My Big Fig mattress was super easy online and took about a month. When my bed was ready to be delivered I was notified via email and had a customer service rep checking in on the status of its arrival as well. I easily scheduled my delivery and the driver called me 30 minutes before he arrived to let me know he was close. The mattress and box spring arrived on time and with two men who removed my old mattress and disposed of it for me thankfully. The men quickly assembled the whole frame and mattress in about 30 minutes.Im not going to lie, I have had this bed for a full month and the first night on my mattress was an odd one. Because this bed is made of high density foam it is meant to withstand 20 years of wear and tear along with support up to 2,000 lbs. Immediately I noticed how much firmer the new mattress was then my last one but quickly realized how much better the firm nature was for my body. After about three days I was fully adjusted to the new feel and was obsessed with how much better I was sleeping. Now after one month, the hip pain that I would keep waking up to because I tend to stay on one side when I sleep was completely gone!After working so hard on my blog, writing for Yahoo, hosting, and dropping my album I feel so lucky to have found something that allows me to get the rest I need so that I can conquer everything I need to when I wake!Check out Big Fig mattress HERE and let me know what you think..

lowercased: since harald and i are currently in the midst of some redecorating for spring i am so excited to be doing my first mattress review for the revamp! truth be told my whole life i have always struggled finding the right mattress for my plus size stature. all of my mattresses throughout my life have always been too soft and would always quickly wear out specifically at the point where i sleep. specifically this last year i noticed i was having a lot more back and hip problems. living in nyc and freelancing from home there i tend to use my bed a lot more then people working a 9-5pm job. i had seen a review of the brand on my good friend ashley nell tipton page i knew i needed to try it out!the order to delivery process for my my big fig mattress was super easy online and took about a month. when my bed was ready to be delivered i was notified via email and had a customer service rep checking in on the status of its arrival as well. i easily scheduled my delivery and the driver called me 30 minutes before he arrived to let me know he was close. the mattress and box spring arrived on time and with two men who removed my old mattress and disposed of it for me thankfully. the men quickly assembled the whole frame and mattress in about 30 minutes.im not going to lie, i have had this bed for a full month and the first night on my mattress was an odd one. because this bed is made of high density foam it is meant to withstand 20 years of wear and tear along with support up to 2,000 lbs. immediately i noticed how much firmer the new mattress was then my last one but quickly realized how much better the firm nature was for my body. after about three days i was fully adjusted to the new feel and was obsessed with how much better i was sleeping. now after one month, the hip pain that i would keep waking up to because i tend to stay on one side when i sleep was completely gone!after working so hard on my blog, writing for yahoo, hosting, and dropping my album i feel so lucky to have found something that allows me to get the rest i need so that i can conquer everything i need to when i wake!check out big fig mattress here and let me know what you think..


text:
Foyer Hanging Lights #1 Kichler Wooden Foyer Pendant Light Perfect Modern Ancient Style Lantern Black Color Natural Component .
Amazing Foyer Hanging Lights #3 Home Designs Clever Candle Pendant Light Grand Framed Brushed Nickel Foyer Lamp Kitchen Ideas Bright Fixture .
The article of Foyer Hanging Lights was published at August 23, 2018 at 4:24 pm. This image is posted at the Lighting category. Foyer Hanging Lights is labelled with Foyer Hanging Lights, Foyer, Hanging, Lights..
Are you having trouble deciding which lights is going to be picked for simply just, or your Foyer Hanging Lights the best lighting design for-you? Because we will provide you with four incredible recommendations on just how to pick the ideal light to your bedroom well, nowadays is the lucky morning! Bedside lamps are a necessity in nearly every room.
Nevertheless, sometimes it is not enough, which means you must look into it to consider exactly how many plainly educated places you need to have in your room. You opt for only a little wall sconce a lamp as your bedside lamp and can go along with unique strategies.
The thing that is important would be to pick the solution that best fits your preferences whether appearance or their house is linked. It's important to determine why the particular light is put here and not there.
Lighting is really a major a part of your Foyer Hanging Lights, so you do not wish to play with all you've setup by simply choosing the wrong lighting. Really think of the appearance you would like to accomplish, and carry it. Styles throughout your lighting should you choose medieval style, then choose a medieval light.
Thus ensure that you prepare ahead how and why you'll make use of a specific type of Foyer Hanging Lights, and choose. Is it supposed to illuminate the complete area? Is it to highlight a nook that is dim? Could it be applied merely as a reading light or atmosphere? This goes hand in hand with all the previous idea because occasionally the bedroom can also be a place for reading, enjoying TV, exercising and also functioning.
In case you have a workspace inside your bedroom, make sure to include lights or a table near the space and research delayed during the night. And, ofcourse, if you have a decent wardrobe, be sure in determining how much lighting you will require inside your bedroom, to consider that space.

lowercased:
foyer hanging lights #1 kichler wooden foyer pendant light perfect modern ancient style lantern black color natural component .
amazing foyer hanging lights #3 home designs clever candle pendant light grand framed brushed nickel foyer lamp kitchen ideas bright fixture .
the article of foyer hanging lights was published at august 23, 2018 at 4:24 pm. this image is posted at the lighting category. foyer hanging lights is labelled with foyer hanging lights, foyer, hanging, lights..
are you having trouble deciding which lights is going to be picked for simply just, or your foyer hanging lights the best lighting design for-you? because we will provide you with four incredible recommendations on just how to pick the ideal light to your bedroom well, nowadays is the lucky morning! bedside lamps are a necessity in nearly every room.
nevertheless, sometimes it is not enough, which means you must look into it to consider exactly how many plainly educated places you need to have in your room. you opt for only a little wall sconce a lamp as your bedside lamp and can go along with unique strategies.
the thing that is important would be to pick the solution that best fits your preferences whether appearance or their house is linked. it's important to determine why the particular light is put here and not there.
lighting is really a major a part of your foyer hanging lights, so you do not wish to play with all you've setup by simply choosing the wrong lighting. really think of the appearance you would like to accomplish, and carry it. styles throughout your lighting should you choose medieval style, then choose a medieval light.
thus ensure that you prepare ahead how and why you'll make use of a specific type of foyer hanging lights, and choose. is it supposed to illuminate the complete area? is it to highlight a nook that is dim? could it be applied merely as a reading light or atmosphere? this goes hand in hand with all the previous idea because occasionally the bedroom can also be a place for reading, enjoying tv, exercising and also functioning.
in case you have a workspace inside your bedroom, make sure to include lights or a table near the space and research delayed during the night. and, ofcourse, if you have a decent wardrobe, be sure in determining how much lighting you will require inside your bedroom, to consider that space.


text:
With sports magazines in the waiting room and radio and TV spots that promise to put men first, "divorce for men" law firms position themselves as the best defense a soon-to-be-ex-husband could have in the struggle to keep his kids, his house and his money.
They say their expertise lends firepower in situations where other lawyers might cave, and they coach men on how to avoid certain snares. For instance, if you want to stay in your house, steer clear of confrontations—especially in front of witnesses—that could provide fodder for a restraining order.
"We have experience swimming upstream," said Bill Goldberg, co-founder of Goldberg Jones, a Seattle-based men's divorce firm with offices in Portland and San Diego. "We don't pretend that we are going to pull miracles for men. But we are very, very familiar with the biases and challenges."
Such firms charge about the same hourly rates as other family-law practices—generally in the range of $200 to $350 an hour, plus a retainer.
'From the first time I heard their ad—that they cater to men and put them first—that's how I felt through the whole process,' says Taylor Myers of his divorce lawyers.
Getting divorced isn't cheap. An amicable separation that doesn't end up in court could run in the low thousands of dollars, while custody disputes or battles over property can cost many more thousands, or even millions, by the time a divorce is final.
The "divorce for men" pitch has proved a durable one. Some lawyers have been working this angle for decades, since men's rights groups began pushing back in the 1970s and 1980s against divorce and custody laws that they said favored women at the expense of their former spouses.
Now it's easier than ever before to find such lawyers as firms expand their online profiles with Web sites and blogs laden with keywords designed to boost them to the top of Internet search results.
When Mark Faulkner of Round Rock, Texas, was looking for a divorce lawyer last year, his sister emailed him a link to the website of Cordell & Cordell, which says it is ne of the country's largest family-law firms specializing in male clients.
The firm maintains three separate sites: one promoting the law firm, one for divorced dads, and a third focused on men's rights that features headlines such as "Child Support When Paternity Is in Doubt" and "Are There Laws to Protect a Man From an Ex-Wife's False Report?"
They struck a chord, said Mr. Faulkner, who runs a repair shop that fixes parts for high-end private airplanes. "Even the marriage counselor said, 'Make sure you get a good attorney because the system is prejudiced'" against men.
Not everyone is convinced of the need for such specialists. Some family-law practitioners say the outcome of a divorce depends largely on state law, what judge you get, and whether you have competent representation.
"Look at the marketing for men saying, 'We're going to help you keep the dollars you've earned.' Wait a minute—you can't change Missouri law," said Ann Bauer, a St. Louis family-law practitioner and past chair of the Missouri Bar's family-law section. "Pretty much we're going to divide the property down the middle."
To be sure, some men do get the short end of the stick in divorce proceedings. But attitudes—and divorce statutes—have shifted in recent decades.
"In this day and age, fathers have lots of rights," said Ken Altshuler, president of the American Academy of Matrimonial Lawyers. "We have shared custody, and the law in most states is really gender neutral."
Some states are moving to cap spousal support so that recipients, who are often but not always women, no longer get lifetime alimony. Mothers are increasingly paying child support, according to a recent survey of members of the American Academy of Matrimonial Lawyers. And as women's earnings equal or, in some cases, outpace those of their partners, some ex-wives even end up paying alimony.
"I always see judges wincing when they order women to pay alimony," said Mr. Altshuler. "But it's a trend.... Now we have so many families where both parents are working, the whole 'man takes care of the woman' syndrome has diminished."
Despite those changes, some lawyers who specialize in representing men say their clients still encounter discrimination from judges who are reluctant to view men as equally capable parents or deserving of spousal support. Joseph Cordell, the co-founder of Cordell & Cordell, said women may also resort to a tactic few men employ: accusations of domestic violence. "It could be as little as a shove or a raised voice," said Mr. Cordell. "The cascade of events triggered by that affect property distribution, custody, attorney fees."
Other firms focus on educating clients on the rights they already have but may not be exercising.
"Men don't know what they need to know," said Santa Monica divorce lawyer David Pisarra, who said his firm, Men's Family Law, "is about empowering men, not bashing women." He and his partner focus on making sure their male clients don't unwittingly sabotage their own goals—for instance, by moving 35 miles from their children's school, then seeking joint custody.
Mr. Goldberg started his firm in the mid-1990s after his father, who worked in advertising, devised a campaign for a Detroit men's divorce firm known as ADAM, or American Divorce Association for Men. "He had always thought that as a business-opportunity concept, this is something that would work well on the West Coast, in Seattle," Mr. Goldberg said.
The angle has also been fruitful for Mr. Pisarra's firm. "In the giant ocean of data on the Internet, you've got to become as niche-focused as possible," he said.
Marketing seems to be key. When Cordell & Cordell decided to focus on a male clientele in 1996, the firm invested heavily in its websites—a bet that Mr. Cordell said paid off a few years later and helped fuel the firm's expansion to more than 60 offices across 24 states. The firm also runs radio spots and tasteful, high-end TV ads.
The pitch certainly resonated with Taylor Myers, an electrical technician who lives in Memphis, Tenn. When Mr. Myers's wife served him with divorce papers last year, he opted for a Cordell & Cordell attorney after hearing one of the firm's radio spots.
"From the first time I heard their ad—that they cater to men and put them first—that's how I felt through the whole process," said Mr. Myers, 36 years old. "I don't think it's a ploy. He's hit on something right."

lowercased:
with sports magazines in the waiting room and radio and tv spots that promise to put men first, "divorce for men" law firms position themselves as the best defense a soon-to-be-ex-husband could have in the struggle to keep his kids, his house and his money.
they say their expertise lends firepower in situations where other lawyers might cave, and they coach men on how to avoid certain snares. for instance, if you want to stay in your house, steer clear of confrontations—especially in front of witnesses—that could provide fodder for a restraining order.
"we have experience swimming upstream," said bill goldberg, co-founder of goldberg jones, a seattle-based men's divorce firm with offices in portland and san diego. "we don't pretend that we are going to pull miracles for men. but we are very, very familiar with the biases and challenges."
such firms charge about the same hourly rates as other family-law practices—generally in the range of $200 to $350 an hour, plus a retainer.
'from the first time i heard their ad—that they cater to men and put them first—that's how i felt through the whole process,' says taylor myers of his divorce lawyers.
getting divorced isn't cheap. an amicable separation that doesn't end up in court could run in the low thousands of dollars, while custody disputes or battles over property can cost many more thousands, or even millions, by the time a divorce is final.
the "divorce for men" pitch has proved a durable one. some lawyers have been working this angle for decades, since men's rights groups began pushing back in the 1970s and 1980s against divorce and custody laws that they said favored women at the expense of their former spouses.
now it's easier than ever before to find such lawyers as firms expand their online profiles with web sites and blogs laden with keywords designed to boost them to the top of internet search results.
when mark faulkner of round rock, texas, was looking for a divorce lawyer last year, his sister emailed him a link to the website of cordell & cordell, which says it is ne of the country's largest family-law firms specializing in male clients.
the firm maintains three separate sites: one promoting the law firm, one for divorced dads, and a third focused on men's rights that features headlines such as "child support when paternity is in doubt" and "are there laws to protect a man from an ex-wife's false report?"
they struck a chord, said mr. faulkner, who runs a repair shop that fixes parts for high-end private airplanes. "even the marriage counselor said, 'make sure you get a good attorney because the system is prejudiced'" against men.
not everyone is convinced of the need for such specialists. some family-law practitioners say the outcome of a divorce depends largely on state law, what judge you get, and whether you have competent representation.
"look at the marketing for men saying, 'we're going to help you keep the dollars you've earned.' wait a minute—you can't change missouri law," said ann bauer, a st. louis family-law practitioner and past chair of the missouri bar's family-law section. "pretty much we're going to divide the property down the middle."
to be sure, some men do get the short end of the stick in divorce proceedings. but attitudes—and divorce statutes—have shifted in recent decades.
"in this day and age, fathers have lots of rights," said ken altshuler, president of the american academy of matrimonial lawyers. "we have shared custody, and the law in most states is really gender neutral."
some states are moving to cap spousal support so that recipients, who are often but not always women, no longer get lifetime alimony. mothers are increasingly paying child support, according to a recent survey of members of the american academy of matrimonial lawyers. and as women's earnings equal or, in some cases, outpace those of their partners, some ex-wives even end up paying alimony.
"i always see judges wincing when they order women to pay alimony," said mr. altshuler. "but it's a trend.... now we have so many families where both parents are working, the whole 'man takes care of the woman' syndrome has diminished."
despite those changes, some lawyers who specialize in representing men say their clients still encounter discrimination from judges who are reluctant to view men as equally capable parents or deserving of spousal support. joseph cordell, the co-founder of cordell & cordell, said women may also resort to a tactic few men employ: accusations of domestic violence. "it could be as little as a shove or a raised voice," said mr. cordell. "the cascade of events triggered by that affect property distribution, custody, attorney fees."
other firms focus on educating clients on the rights they already have but may not be exercising.
"men don't know what they need to know," said santa monica divorce lawyer david pisarra, who said his firm, men's family law, "is about empowering men, not bashing women." he and his partner focus on making sure their male clients don't unwittingly sabotage their own goals—for instance, by moving 35 miles from their children's school, then seeking joint custody.
mr. goldberg started his firm in the mid-1990s after his father, who worked in advertising, devised a campaign for a detroit men's divorce firm known as adam, or american divorce association for men. "he had always thought that as a business-opportunity concept, this is something that would work well on the west coast, in seattle," mr. goldberg said.
the angle has also been fruitful for mr. pisarra's firm. "in the giant ocean of data on the internet, you've got to become as niche-focused as possible," he said.
marketing seems to be key. when cordell & cordell decided to focus on a male clientele in 1996, the firm invested heavily in its websites—a bet that mr. cordell said paid off a few years later and helped fuel the firm's expansion to more than 60 offices across 24 states. the firm also runs radio spots and tasteful, high-end tv ads.
the pitch certainly resonated with taylor myers, an electrical technician who lives in memphis, tenn. when mr. myers's wife served him with divorce papers last year, he opted for a cordell & cordell attorney after hearing one of the firm's radio spots.
"from the first time i heard their ad—that they cater to men and put them first—that's how i felt through the whole process," said mr. myers, 36 years old. "i don't think it's a ploy. he's hit on something right."


text:
Commission chairman David Dennis called for the moratorium after attending a Reno County meeting last year that resulted in approval for a wind farm project. He said he left that meeting with more questions than answers, and he said Sedgwick County does not have a set of rules for any kind of alternative energy projects.
Sedgwick County commissioners have approved a six-month moratorium on applications for wind and solar power projects.
Commission chairman David Dennis called for the moratorium after attending a Reno County meeting last year that resulted in approval for a wind farm project. He said he left that meeting with more questions than answers, and he said Sedgwick County does not have a set of rules for any kind of alternative energy projects. He said a moratorium will give county staff time to prepare zoning regulations that would apply to wind and solar developments. Dennis stressed that the county is not taking a position for or against alternative energy with this moratorium.
Assistant county counselor Justin Waggoner said there are no applications with Sedgwick County for wind and solar projects, but there are leases on properties in the western part of the county that could have applications at a later time. Waggoner said the moratorium will not apply to small projects such as a home solar panel, but it will apply to large commercial developments.
County staff could have proposed regulations ready for the commission as soon as May.

lowercased:
commission chairman david dennis called for the moratorium after attending a reno county meeting last year that resulted in approval for a wind farm project. he said he left that meeting with more questions than answers, and he said sedgwick county does not have a set of rules for any kind of alternative energy projects.
sedgwick county commissioners have approved a six-month moratorium on applications for wind and solar power projects.
commission chairman david dennis called for the moratorium after attending a reno county meeting last year that resulted in approval for a wind farm project. he said he left that meeting with more questions than answers, and he said sedgwick county does not have a set of rules for any kind of alternative energy projects. he said a moratorium will give county staff time to prepare zoning regulations that would apply to wind and solar developments. dennis stressed that the county is not taking a position for or against alternative energy with this moratorium.
assistant county counselor justin waggoner said there are no applications with sedgwick county for wind and solar projects, but there are leases on properties in the western part of the county that could have applications at a later time. waggoner said the moratorium will not apply to small projects such as a home solar panel, but it will apply to large commercial developments.
county staff could have proposed regulations ready for the commission as soon as may.


text:
What is a life changing amount of money?
Financial Planning – helping to answer life’s big questions.
A lovely couple from the Midlands had sold the business that they had spent thirty years building and running. Not for tens of millions but for a good amount of money. They’d had a good life, but not an extravagant one, as they had been focussed on the business, their children and helping the local community. Still relatively young, they had plans to travel, plans to help their family, plans to develop new interests and become more involved in the community and a desire not to ‘work’ again. The question was whether what they had got from the business was a life changing amount of money.
If they left their money on deposit, would it be enough to last them?
This question was relatively simple to answer. With a detailed look at their expenditure and how that might change over time, a discussion about life expectancy, data on pensions and other assets that would be there to support them and a longer discussion on how they felt about leaving money to their children and to charities, the conclusion that we came to was ‘Yes’. Despite low interest rates currently and without projecting high interest rates in the future, if they were happy to use their capital there was every likelihood that it would support them for life without having to invest and take investment risk.
What if they used half of it to buy a smallholding in Cumbria as essentially a second home and hobby?
This question came as a surprise, they’d holidayed there for years, loved the area and had a dream of buying, renovating and managing a smallholding combining modern green technology and traditional land management. With no intention of making this a profitable enterprise, this took capital from what was accessible to support them and added significant initial and ongoing expense. The answer, ‘it depends’. It depends on how long you want to keep the smallholding; it depends on how accurate the estimates of the cost of renovation, development and running the smallholding are; it depends on if you still want a deposit approach with what is left; it depends on what approach to investment you might be comfortable with if you moved some capital from deposit.
The end result has been that we’re now part way through the renovation and development stage, with a plan that is working so far and to which we return regularly to update, adjust and review.
Contact me to set up a meeting for more insight on how you can address life's big questions.

lowercased:
what is a life changing amount of money?
financial planning – helping to answer life’s big questions.
a lovely couple from the midlands had sold the business that they had spent thirty years building and running. not for tens of millions but for a good amount of money. they’d had a good life, but not an extravagant one, as they had been focussed on the business, their children and helping the local community. still relatively young, they had plans to travel, plans to help their family, plans to develop new interests and become more involved in the community and a desire not to ‘work’ again. the question was whether what they had got from the business was a life changing amount of money.
if they left their money on deposit, would it be enough to last them?
this question was relatively simple to answer. with a detailed look at their expenditure and how that might change over time, a discussion about life expectancy, data on pensions and other assets that would be there to support them and a longer discussion on how they felt about leaving money to their children and to charities, the conclusion that we came to was ‘yes’. despite low interest rates currently and without projecting high interest rates in the future, if they were happy to use their capital there was every likelihood that it would support them for life without having to invest and take investment risk.
what if they used half of it to buy a smallholding in cumbria as essentially a second home and hobby?
this question came as a surprise, they’d holidayed there for years, loved the area and had a dream of buying, renovating and managing a smallholding combining modern green technology and traditional land management. with no intention of making this a profitable enterprise, this took capital from what was accessible to support them and added significant initial and ongoing expense. the answer, ‘it depends’. it depends on how long you want to keep the smallholding; it depends on how accurate the estimates of the cost of renovation, development and running the smallholding are; it depends on if you still want a deposit approach with what is left; it depends on what approach to investment you might be comfortable with if you moved some capital from deposit.
the end result has been that we’re now part way through the renovation and development stage, with a plan that is working so far and to which we return regularly to update, adjust and review.
contact me to set up a meeting for more insight on how you can address life's big questions.


text:
Monturpie is stunningly set in an elevated position overlooking the Firth of Forth with fantastic views across to Edinburgh and North Berwick. We are ideally situated just a short drive from St Andrews and the East Neuk of Fife; Edinburgh is only a 45 minute drive away with the rest of Scotland to explore at your leisure.
28 caravan / motorhome pitches - all electric hookups.
A majority are hard standings.
Lovely heated toilet / shower block / launderette with disabled facilities.
Pitches very well spaced out to give all visitors magnificent uninterrupted views overlooking the Firth of Forth.
Ideally located for visitors to the East Neuk of Fife, St Andrews and the East Coast of Scotland.
An adult only site allows the best opportunity for those of us that are looking for an all important relaxing peaceful break.
A rally field is available for bookings in advance (Up to 40 pitches), contact us for further information.
We also have a small licensed restaurant on site providing lovely home baking and traditional high teas.

lowercased:
monturpie is stunningly set in an elevated position overlooking the firth of forth with fantastic views across to edinburgh and north berwick. we are ideally situated just a short drive from st andrews and the east neuk of fife; edinburgh is only a 45 minute drive away with the rest of scotland to explore at your leisure.
28 caravan / motorhome pitches - all electric hookups.
a majority are hard standings.
lovely heated toilet / shower block / launderette with disabled facilities.
pitches very well spaced out to give all visitors magnificent uninterrupted views overlooking the firth of forth.
ideally located for visitors to the east neuk of fife, st andrews and the east coast of scotland.
an adult only site allows the best opportunity for those of us that are looking for an all important relaxing peaceful break.
a rally field is available for bookings in advance (up to 40 pitches), contact us for further information.
we also have a small licensed restaurant on site providing lovely home baking and traditional high teas.


text:
Get up to date with the latest research and developments in the field of eating disorders.
Share skills and experiences as you network with clinicians and researchers from across the globe.
Join training workshops and develop your practical skills within new technologies and therapies.
“It was even better than anticipated and I found it to be informative and inspiring!

lowercased:
get up to date with the latest research and developments in the field of eating disorders.
share skills and experiences as you network with clinicians and researchers from across the globe.
join training workshops and develop your practical skills within new technologies and therapies.
“it was even better than anticipated and i found it to be informative and inspiring!


text:
Welcome to the New Oklahoma City Vision Source Website!
Copyright © 2019 Oklahoma City Vision Source. All rights reserved.

lowercased:
welcome to the new oklahoma city vision source website!
copyright © 2019 oklahoma city vision source. all rights reserved.


text:
Teacher Appreciation | BOGO Free Chipolte Menu Item!
Home / Deals / Teacher Appreciation | BOGO Free Chipolte Menu Item!
Teachers can celebrate Teacher Appreciation Day by stopping by Chipolte for a BOGO Free Chipolte Menu Item! On May 6th from 4pm to close, all educators can stop by and get a FREE burrito, bowl, salad or order of tacos when you buy one! Just show your valid school id.
Be sure to shrae this post with all of the wonderful teacher’s you know!
And don’t miss out on all of the other great Teacher Freebies available for 2014!
Quaker Chewy Coupon on Amazon | As low as $1.50 per Box + FREE Shipping!

lowercased:
teacher appreciation | bogo free chipolte menu item!
home / deals / teacher appreciation | bogo free chipolte menu item!
teachers can celebrate teacher appreciation day by stopping by chipolte for a bogo free chipolte menu item! on may 6th from 4pm to close, all educators can stop by and get a free burrito, bowl, salad or order of tacos when you buy one! just show your valid school id.
be sure to shrae this post with all of the wonderful teacher’s you know!
and don’t miss out on all of the other great teacher freebies available for 2014!
quaker chewy coupon on amazon | as low as $1.50 per box + free shipping!


text:
Previous occupied by the owners, and meticulously maintained, this is a lovely example of a 2 bedroom villa.
This villa is sitting at the back of the block tucked away in its own private corner with a low maintenance courtyard with a new deck.
With polished floor boards in the lounge and kitchen area, its flows into the generous bedrooms both with built in robes and ceiling fans.
The villa has a full sized bathroom with a second toilet located in the laundry. The villa also has a large lock up garage with internal access to the back yard and also a small storage locker in the rear yard.

lowercased:
previous occupied by the owners, and meticulously maintained, this is a lovely example of a 2 bedroom villa.
this villa is sitting at the back of the block tucked away in its own private corner with a low maintenance courtyard with a new deck.
with polished floor boards in the lounge and kitchen area, its flows into the generous bedrooms both with built in robes and ceiling fans.
the villa has a full sized bathroom with a second toilet located in the laundry. the villa also has a large lock up garage with internal access to the back yard and also a small storage locker in the rear yard.


text:
The interior design of the property leaves little to be desired. The fantastic open plan living/ kitchen area is breathtakingly light with a large bay window and high ceilings only adding to the grandeur of the room. The kitchen worktops are thick corian which are beautiful and fluid. Throughout this apartment built-in bespoke storage is plentiful, providing a most helpful feature.
Upon reaching the next floor, the guest and master suite can be found. Both bedrooms are good size doubles with the rear bedroom enjoying views over the well-presented and sizeable garden and the front bedroom offering views of tree-top greenery.
The family bathroom is modern with a sunken bath, skylight and feature glass floor panel, providing the perfect place to relax.
The garden is a real feature of this property. To be so close to the centre of town and to have this size of outside space is a real treat. It has been covered with modern astro-turf for year round use and is surrounded by white walls and comes with a great storage shed fitted with electricity.
This home is a hidden oasis in the midst of the city, a tranquil and calming place to retreat to.
Property reference BTN170091. The information displayed about this property comprises a property advertisement. OnTheMarket.com makes no warranty as to the accuracy or completeness of the advertisement or any linked or associated information, and OnTheMarket.com has no control over the content. This property advertisement does not constitute property particulars. The information is provided and maintained by Winkworth - Brighton. Please contact the selling agent directly to obtain any information which may be available under the terms of The Energy Performance of Buildings (Certificates and Inspections) (England and Wales) Regulations 2007 or the Home Report if in relation to a residential property in Scotland.

lowercased:
the interior design of the property leaves little to be desired. the fantastic open plan living/ kitchen area is breathtakingly light with a large bay window and high ceilings only adding to the grandeur of the room. the kitchen worktops are thick corian which are beautiful and fluid. throughout this apartment built-in bespoke storage is plentiful, providing a most helpful feature.
upon reaching the next floor, the guest and master suite can be found. both bedrooms are good size doubles with the rear bedroom enjoying views over the well-presented and sizeable garden and the front bedroom offering views of tree-top greenery.
the family bathroom is modern with a sunken bath, skylight and feature glass floor panel, providing the perfect place to relax.
the garden is a real feature of this property. to be so close to the centre of town and to have this size of outside space is a real treat. it has been covered with modern astro-turf for year round use and is surrounded by white walls and comes with a great storage shed fitted with electricity.
this home is a hidden oasis in the midst of the city, a tranquil and calming place to retreat to.
property reference btn170091. the information displayed about this property comprises a property advertisement. onthemarket.com makes no warranty as to the accuracy or completeness of the advertisement or any linked or associated information, and onthemarket.com has no control over the content. this property advertisement does not constitute property particulars. the information is provided and maintained by winkworth - brighton. please contact the selling agent directly to obtain any information which may be available under the terms of the energy performance of buildings (certificates and inspections) (england and wales) regulations 2007 or the home report if in relation to a residential property in scotland.


text:
Also just a girl, sitting in front of a computer… asking you to love her silly words.
In the middle of Sydney’s loud and lavish CBD lies a delightfully tranquil sanctuary. In Tumbalong Park, a stone’s throw from the milling touristy crowds of Darling Harbour, you’ll find the Chinese Garden of Friendship, nonchalantly tucked away behind a couple of high walls.
In celebration of the long association of the Chinese community in Australia, this beautiful garden was conceived and created in the 1980s, a gift to Sydney from the city of Guangzhou (southern China).
The garden adheres to the Taoist principles of Yin-Yang, with the five opposite elements represented – earth, fire, water, metal and wood – for balance, and ‘Qi’, the circulating force of life and energy.
I’ve visited this place four times, and I’m always staggered by how quiet it is. The low roar of the relentless traffic, elsewhere in the CBD inescapable, here seems so distant. And despite the imposing backdrop of hotels and shiny office complexes, it somehow still feels like an escape. A peaceful place offering refuge from the noise and bustle of the metropolis. For the most part, all you can hear is the soft waterfall, and the occasional scampering of a camera-shy amphibian.
I recommend you visit. There’s charm in the calm. It’s good for the soul. And at just $6 entry, in a city that typically commands a hefty price tag, it’s easy on your pocket too.
You can’t beat a nice dragon, especially in such a lovely setting. Beautiful photos.
It is a truly beautiful place.

lowercased:
also just a girl, sitting in front of a computer… asking you to love her silly words.
in the middle of sydney’s loud and lavish cbd lies a delightfully tranquil sanctuary. in tumbalong park, a stone’s throw from the milling touristy crowds of darling harbour, you’ll find the chinese garden of friendship, nonchalantly tucked away behind a couple of high walls.
in celebration of the long association of the chinese community in australia, this beautiful garden was conceived and created in the 1980s, a gift to sydney from the city of guangzhou (southern china).
the garden adheres to the taoist principles of yin-yang, with the five opposite elements represented – earth, fire, water, metal and wood – for balance, and ‘qi’, the circulating force of life and energy.
i’ve visited this place four times, and i’m always staggered by how quiet it is. the low roar of the relentless traffic, elsewhere in the cbd inescapable, here seems so distant. and despite the imposing backdrop of hotels and shiny office complexes, it somehow still feels like an escape. a peaceful place offering refuge from the noise and bustle of the metropolis. for the most part, all you can hear is the soft waterfall, and the occasional scampering of a camera-shy amphibian.
i recommend you visit. there’s charm in the calm. it’s good for the soul. and at just $6 entry, in a city that typically commands a hefty price tag, it’s easy on your pocket too.
you can’t beat a nice dragon, especially in such a lovely setting. beautiful photos.
it is a truly beautiful place.


text: You're reading DOLO's Destiny Pill Chapter 22 at ww1.MangaFox.online Please visit our website regularly to update the latest chapters of the series. You can press the F11 button to read mangafox in full-screen mode (PC only). Please support our team by bookmarking MangaFox.online and introduce your friends to read the manga here. We always update the latest and most complete series for you. Pleased to serve you, thank you!

lowercased: you're reading dolo's destiny pill chapter 22 at ww1.mangafox.online please visit our website regularly to update the latest chapters of the series. you can press the f11 button to read mangafox in full-screen mode (pc only). please support our team by bookmarking mangafox.online and introduce your friends to read the manga here. we always update the latest and most complete series for you. pleased to serve you, thank you!


text:
We were contacted to provide a quote for the on-site spraying of fireproof paint to a large number of steel columns and steel beams inside a large building in Blackpool. We conducted a free site survey to assess the property and provide a tender for the necessary painting needed to meet their requirements and comply with the fire protection regulations.
After agreeing to our free price quote, we began work immediately coating the interior metal beams with a 60-minute fire retardant intermittent paint changing the colour from red to white.
Once the work was complete, the client has issued with the correct fire resistant certification.
Please see before and after photos below of the fire resistant coatings we applied.
If you would like a free quote for the price of fire retardant intumescent painting in Blackpool from a reliable on-site spraying company, please contact us for a no obligation quotation.

lowercased:
we were contacted to provide a quote for the on-site spraying of fireproof paint to a large number of steel columns and steel beams inside a large building in blackpool. we conducted a free site survey to assess the property and provide a tender for the necessary painting needed to meet their requirements and comply with the fire protection regulations.
after agreeing to our free price quote, we began work immediately coating the interior metal beams with a 60-minute fire retardant intermittent paint changing the colour from red to white.
once the work was complete, the client has issued with the correct fire resistant certification.
please see before and after photos below of the fire resistant coatings we applied.
if you would like a free quote for the price of fire retardant intumescent painting in blackpool from a reliable on-site spraying company, please contact us for a no obligation quotation.