TweetFollow Us on Twitter

Disassembler
Volume Number:1
Issue Number:6
Column Tag:MacNosy

A New Disassembler

By Steve Jasik

A New Disassembler

As a compiler writer specializing in code generation, I decided to build a Disassembler to better understand the Motorola 68000 and the Macintosh operating system. Given the poor quality of the documentation and the general lack of source listings, a powerful disassembler is a useful tool for debugging and getting information about the system.

MacNosy and its helper programs consist of over 7000 lines of Pascal and about 300 lines of assembly lanaguage code. Internally, MacNosy contains many features usually associated with a compiler such as a table manager, symbol table enter/lookup routines, a reference map, global flow analysis, etc.

Features

MacNosy has many features that place it an order of magnitude above other disassemblers. They include:

• Symbol dictionaries of the Rom names and global symbols (0 - $B00) along with value to symbol substitution in appropriate places.

• Selective list of procedures in a file by procedure name or substring.

• Ability to place the disassembled output on a file in assembler listing output or assembler input format (MDS “.list” or “.asm” format).

• References to the symbols are collected and may be selectively viewed.

• Ability to search the program file for references to selected address’s, trap (rom) calls, resource type references, constant or string references.

• Ability to translate the segment relative address of an instruction to the disk file relative address for code patching purposes.

• MacNosy records its input on a “.jrnl” file (in text format) for later playback. This feature is used as an educational tool and as a medium of communication between developers, hackers, etc.

• Ability to reformat data in its “natural format” via directives. This is in addition to the automatic recognition of various character string formats.

• A full or selective listing of the resources in a file. Format is similar to that of the Resource Mover, but you get more information with less work.

• A built-in mini editor to view files without leaving Nosy.

Facts and Specifications

MacNosy runs on a 512K Mac or a 1 Meg Lisa under the Workshop O.S. or the Macworks environment.

It is capable of disassembling the resource fork of any application file, ROM, Macsbug, and various resource types in the System file (DRVR, PACK, INIT, CDEF, WDEF, etc). Note that source listing of the WDEF, CDEF procedures come with the MacSupplement.

The released disk contains both the Mac and Lisa versions of MacNosy, some sample “.jrnl’ files to acquaint you with it, source code for the table manager (this may be useful to other developers) and the SfGetFile routines so you can see how it selects files to disassemble.

How does MacNosy work?

When disassembling a file, one must know the structure (code or data) of a given piece of the file. To do this, Nosy uses the fact that every program has a “call graph”. The nodes of the graph are the procedures and the edges are the calls (A calls B, etc). As Nosy is primarily interested in the size of the nodes, it ignores some aspects of the graph (such as recursion) which leads to cycles in the graph. Because of this, the graph reduces to a Directed Acyclic (without cycles) Graph. We can get sloppy in our terminology and refer to the DAG as a “tree of procedures”.

Discovering the size and extent of a procedure is a messy problem that entails disassembling instructions, and looking for the procedure exits. The potential presence of spaghetti code makes the algorithm more complicated.

At this point a reasonable strategy is to treat the file as a collection of code and data blocks (contigious set of bytes). We start at the entry points and walk the tree until all possible procedures have been discovered. The remaining areas are caterogized as “data” blocks. During the tree walk Nosy builds symbol tables for the various categories of labels which are:

Procedure (JSR X) X = proc’nnn’ or the 8 character name following the proc if compiled by Lisa Pascal with the D+ option on.

Global labels ( X(A5) )

X = glob’nnn’

Data labels (LEA X or PEA X)

X = data’nnn’

Common labels (JMP X, Bcc X from another proc) - com_’nnn’

Local labels within a procedure - loc_’nnn’

You can change the names of all but the local labels in Nosy.

Example 1 - A fragment of the resource list of a System file.

Note that for the DITL’s the accompanying text/controls are listed.

      26 resource types, data index =   100
Type FRSV    att   indx  length   name
  ID     1     00   CF12        A        0      0
Type ALRT    att   indx  length   name
  ID  -3997   20   CDBC       C        0        0
  ID  -3996   20   CDCC       C        0        0
  ID  -3995   20   CDDC       C        0        0
  ID  -3994   20   CDEC       C        0        0
Type DITL    att   indx  length   name
  ID  -15936  20   BA6C      1E    
  ID   -6047  20   CA18     1A6    <Initialize> <Eject> <OK> 
                               Do you want to initialize it? 
                               This disk is unreadable: 
                                This disk is damaged: 
                               This is not a Macintosh disk: 
                               Please name this disk: 
                               Initializing disk . . .  
                               Initialization failed! 
                               Initialize this disk? 
  ID   -4000  20   CC7C      A8    <Open> <O> <Cancel> <Eject> <Drive> 
h 
  ID   -3999  20   CD28      90    <Save> <Cancel> Save as: <Eject> <Drive> 

Example 2 - code fragment from a little test program I wrote.

The output listing format is:

aaa: hhhh hhhh ‘cccc’ label opcode address $ssaaaaaa

aaa = segment relative address , hhhh and ccccc are the value of the instruction in hex and ascii. The field ssaaaaaa is the address of any label or symbol reference in the

address field. ss is the segment number of the reference.

I have suppressed leading zeros in most cases and many of the numeric formats use decimal conversion. The macros POP and PUSH have the obvious meaning. The QUAL pseudo implies that all the labels of the form loc_nnn are local to the procedure. The line right after it tells us who calls it. The line with “_Button” is a trap macro. The DNAME macro expands to the 8 character name which is used by Lisabug and Nosy.

    440:                                 QUAL    CHK_USER
                                ; refs - TEST  
    440:                                  
    440: 4E56 0000      ‘NV..’  CHK_USER LINK    A6,#0
    444: 4267           ‘Bg’             CLR     -(A7)
    446: A974           ‘.t’             _Button 
    448: 101F           ‘..’             POP.B   D0
    44A: 6714           ‘g.’             BEQ     loc_2               
      $1000460
    44C: 2F0E           ‘/.’             PUSH.L  A6
    44E: 4EBA FFC0      ‘N...’           JSR     WAITBUTT            
      $1000410
    452: 4267           ‘Bg’    loc_1    CLR     -(A7)
    454: A974           ‘.t’             _Button 
    456: 101F           ‘..’             POP.B   D0
    458: 67F8           ‘g.’             BEQ     loc_1               
      $1000452
    45A: 2F0E           ‘/.’             PUSH.L  A6
    45C: 4EBA FFB2      ‘N...’           JSR     WAITBUTT            
      $1000410
    460: 4E5E           ‘N^’    loc_2    UNLK    A6
    462: 4E75           ‘Nu’             RTS     
    464:                                  
    464: C348                   data21   DNAME   CHK_USER,0,2

Example 3 - This next routine was dumped to the hardcopy file in “.asm” format.

It is suitable for input to the MDS assembler ASM.

         QUAL    WCR
; refs - TEST 
          
WCR      LINK    A6,#0
         PUSH.L  glob13(A5)
         PEA     data19
         CLR     -(A7)
         JSR     %W_STR
         PUSH.L  glob13(A5)
         JSR     %W_LN
         PUSH.L  glob12(A5)
         PEA     glob8(A5)
         PUSH    #255
         JSR     %R_STR
         PUSH.L  glob12(A5)
         JSR     %R_LN
         UNLK    A6
         RTS     
          
data18   DNAME   WCR     ,0,2
          
; refs - WCR+8  
data19   STR     ‘wait for cr’

Example 4 - Note the Value to Symbol substitution in this ROM fragment listing

 404C12: 50F8 0902      ‘P...’  Launch   S_T     LaunchFlag          
      $902
 404C16: 31E8 0004 0936 ‘1....6 loc_2    MOVE    4(A0),CurPageOption 
      $936
 404C1C: 2058           ‘ X’             MOVE.L  (A0)+,A0
 404C1E: 43F8 0910      ‘C...’           LEA     CurApName,A1        
      $910
 404C22: 7020           ‘p ‘             MOVEQ   #32,D0
 404C24: A02E           ‘..’             _BlockMove  

Example 5 - Sample Reference Map listing fragment of the “System Globals” from ROM

      114 HeapEnd      proc203  MaxMem  proc253  
      118 TheZone      proc201  proc203  GetZone  MaxMem  proc212  proc232 
 
                       InitResources  proc852  MoreMasters  InitZone 
 proc204  
                       SetGrowZone  
      11C uTableBase   proc36  proc89  proc96  RDrvrInstall  SystemTask 
 proc942  
                       SystemMenu  OpenDeskacc  BlockMove  com_28

Example 6 - Sample Segment Reference Map listing fragment of Nosy.

Inter seg refs are prefixed with “n/”. This map may be used for procedure balancing.

seg# procedure   fba  blen  refs (seg#/proc) called by
  1] HEAP_OVF    1D6    50   ADD_USED    4/NEW_TBL    
  1] SET_MAX     208   120   CLR_TBL     4/REL_TBLS    3/RTN_PTR    
  1] CLR_TBL     280    46   DI_PROC     3/SEARCH_C    4/DI_FILE     
3/SEARCH_C   
  1] MOVEUP      2AE    80   ADD_USED   
  1] ADD_ENTR    2FE    42   DI_PROC       ENTER_LA      PUT_REF     
  NEW_CASE   
                             ADD_ISPR    3/CHK_PROC    4/NI_FILE     
4/DI_FILE    
                             PROCESS_   
  1] SET_USED    328    44 4/NI_FILE    

Disassemblling the ROM

I Would like to show a sample listing of a piece or two of ROM but I don’t want to start any fights with Apple’s Lawyers. So like sex, I leave it for you to do it in the privacy of your own home.

I found a few interesting things looking around the ROM. One is an interesting piece of unreachable code at 40AD30 which blasts 32 long words into RAM and then hangs. Another is the “come from” code in the rom patch area in the system heap. In many cases bugs were patched by placing a CMPI.L $40xxxx,28(A7) followed by a suitable jump in unrelated routines. A rather obnoxious example is BlockMove which contains 3 such checks. I will be forming a MacNosy Users Group (Special Interest Group) on the Delphi Information Service (800-544-4005) starting in April to study the ROM and swap “jrnl” files. Admission will be limited to registered owners of MacNosy.

Ordering Information

If ordered from the author before May 1, 1985 cost is $55, including sales tax for CA. residents. After that it will be sold in selected stores or direct for $70. Orders should be addressed to:

Steve Jasik

343 Trenton Way

Menlo Park, Ca. 94025

(415-322-1386)

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Capture One 15.3.1 - RAW workflow softwa...
Capture One is a professional RAW converter offering you ultimate image quality with accurate colors and incredible detail from more than 400 high-end cameras - straight out of the box. It offers... Read more
Connect Fonts 23.0.3 - Font management s...
Connect Fonts is the creative professional's font manager. Every professional font manager should deliver the basics: spectacular previews, powerful search tools, and efficient font organization. You... Read more
CleanMyMac X 4.11.0 - Delete files that...
CleanMyMac X makes space for the things you love. Sporting a range of ingenious new features, CleanMyMac lets you safely and intelligently scan and clean your entire system, delete large, unused... Read more
Firefox 102.0 - Fast, safe Web browser.
Firefox offers a fast, safe Web browsing experience. Browse quickly, securely, and effortlessly. With its industry-leading features, Firefox is the choice of Web development professionals and casual... Read more
Hopper Disassembler 5.6.1 - Binary disas...
Hopper Disassembler is a binary disassembler, decompiler, and debugger for 32- and 64-bit executables. It will let you disassemble any binary you want, and provide you all the information about its... Read more
Skim 1.6.11 - PDF reader and note-taker...
Skim is a PDF reader and note-taker for OS X. It is designed to help you read and annotate scientific papers in PDF, but is also great for viewing any PDF file. Skim includes many features and has a... Read more
Alfred 4.6.7 - Quick launcher for apps a...
Alfred is an award-winning productivity application for OS X. Alfred saves you time when you search for files online or on your Mac. Be more productive with hotkeys, keywords, and file actions at... Read more
Transmit 5.8.7 - Excellent FTP/SFTP clie...
Transmit is an excellent FTP (file transfer protocol), SFTP, S3 (Amazon.com file hosting) and iDisk/WebDAV client that allows you to upload, download, and delete files over the internet. With the... Read more
Adobe Lightroom Classic 11.4.1 - Import,...
You can download Lightroom for Mac as a part of Creative Cloud for only $9.99/month with Photoshop, included as part of the photography package. The latest version of Lightroom gives you all of the... Read more
MarsEdit 4.5.9 - Quick and convenient bl...
MarsEdit is a blog editor for OS X that makes editing your blog like writing email, with spell-checking, drafts, multiple windows, and even AppleScript support. It works with with most blog services... Read more

Latest Forum Discussions

See All

Apple Arcade Weekly Round-Up: Major Upda...
Apple recently revealed July’s upcoming Apple Arcade releases in a new App Store Story, and this week’s new release is My Bowling 3D+ featuring offline and online multiplayer support, and more. It arrives from the developers of Pro Darts 2022+ and... | Read more »
Downhill Mountain Biking Game ‘Descender...
Just over three years ago in May of 2019 developer RageSquid and publisher No More Robots released a quirky downhill mountain biking game called Descenders on PC and Xbox One. Bemoaning a lack of “extreme sports" titles in recent years led RageSquid... | Read more »
SwitchArcade Round-Up: ‘Monster Hunter R...
Hello gentle readers, and welcome to the SwitchArcade Round-Up for June 30th, 2022. Thursday is once more upon us, and that means a bunch of new releases to look at. We start things off with DLC for some very big games, Monster Hunter Rise and... | Read more »
‘HOOK 2’ Review – A Sharp Left Hook From...
The original HOOK ($1.99) had a very simple idea behind it. You were presented with a tangled mess of hooks and loops, and you needed to remove each one without snagging any others. Extremely simple at first, but as the puzzles rolled along,... | Read more »
‘Dicey Dungeons’ Mobile Version Launchin...
After a very long wait, Terry Cavanagh’s dungeon crawling roguelite deckbuiler hybrid experience Dicey Dungeons is coming to mobile platforms next week alongside a huge free DLC pack on all platforms. This DLC will be included in the mobile... | Read more »
Distract Yourself With These Great Mobil...
Every day, we pick out a curated list of the best mobile discounts on the App Store and post them here. This list won't be comprehensive, but it every game on it is recommended. Feel free to check out the coverage we did on them in the links below... | Read more »
‘Danganronpa S: Ultimate Summer Camp’ is...
If you’ve been following Danganronp over the last few years, Spike Chunsoft celebrated its anniversary by bringing the series to mobile in the form of anniversary editions. After the first two released, there was a long delay for V3, but it finally... | Read more »
Out Now: ‘HOOK 2’, ‘Incoherence’, ‘Juras...
Each and every day new mobile games are hitting the App Store, and so each week we put together a big old list of all the best new releases of the past seven days. Back in the day the App Store would showcase the same games for a week, and then... | Read more »
Upcoming Mobile MMO RPG Shooter ‘Avatar:...
This past January a contingent of developers made up of Archosaur Games, Tencent, Lightstorm Entertainment, and Disney announced a new mobile game set in James Cameron’s Avatar universe titled Avatar: Reckoning. | Read more »
Culinary Platformer ‘Chefy-Chef’ Coming...
If your name is Chefy, it’s pretty much a given that you should be a chef. Such is the case with Chefy-Chef, a game from Bug Studio about a chef named Chefy who must travel to all sorts of exotic locations using a magical refrigerator in an effort... | Read more »

Price Scanner via MacPrices.net

July 4th sale at Verizon: Apple AirPods Pro f...
Verizon has Apple AirPods Pro on sale for $179.99 on their online store as part of their Fourth of July sale. Their price is $70 (28%) off Apple’s MSRP, and it’s among the lowest prices currently... Read more
Apple is now selling Certified Refurbished Ma...
Apple has added a full line of standard-configuration Mac Studios available in their Certified Refurbished section starting at only $1799 and ranging up to $400 off MSRP. Each Mac Studio comes with... Read more
Open-box 14″ M1 Pro MacBook Pros in stock tod...
QuickShip Electronics has open-box return Space Gray 14″ M1 Pro MacBook Pros in stock and on sale for $300-$450 off MSRP on their eBay store today. According to QuickShip, “The item in this listing... Read more
Can Being An iPhone User Really Determine Whe...
FEATURE: – If you’re traveling on the road today for the July 4th holiday, you might want to keep your Apple smartphone locked up inside the car’s glove compartment for your (and, everyone else’s)... Read more
2nd generation 4K Apple TVs with Siri remote...
Apple has restocked a full line of Certified Refurbished 2nd generation 32GB and 64GB 4K Apple TVs with Siri remotes for $30 off the cost of new models. Apple’s standard one-year warranty is included... Read more
Back in stock: Apple Watch Series 7 models fo...
Apple has restocked Certified Refurbished Apple Watch Series 7 WiFi-only models in their online store for $60-$70 off MSRP, starting at $339. Each Watch includes Apple’s standard one-year warranty, a... Read more
July 4th Sale at Expercom: $200 off any 16″ M...
Apple reseller Expercom has 16″ M1 Pro and M1 Max MacBook Pros available for $200 off MSRP as part of their July 4th sale. In addition to their MacBook Pro sale prices, take $50 off AppleCare+ when... Read more
10.2″ Apple iPads (WiFi models) are on sale f...
Amazon has Apple’s 9th generation 10.2″ WiFi iPads on sale for up to $20-$50 off MSRP for a limited time. Their prices are the lowest price currently available for one of these iPads. All models are... Read more
10-Core M1 Pro 14″ MacBook Pros on sale for $...
B&H Photo is offering $200 discounts on Apple’s new 14″ M1 Pro MacBook Pros with 10-Core CPUs (16GB RAM/1TB SSDs). Free 1-2 day shipping is available to most US addresses, and both models are in... Read more
B&H has 16-inch M1 Pro MacBook Pros in st...
New Space Gray 16″ MacBook Pros with Apple’s M1 Pro CPUs are in stock and on sale today at B&H Photo for $200 off Apple’s MSRP. Sale prices are for M1 Pro models with 512GB or 1TB of SSD storage... Read more

Jobs Board

VP, Software Engineering - *Apple* and Andr...
…Client Application Software Engineering team is seeking a VP, Software Engineering for Apple and Android. You will lead the client engineering team building Disney+, Read more
I/S Senior Engineer - *Apple* Systems Engin...
**19647BR** **Position Title:** I/S Senior Engineer - Apple Systems Engineering - Remote **Department:** Information Systems **Location:** Lakeland, FL between Read more
*Apple* IT Support Analyst - 2nd Shift - Zon...
Apple IT Support Analyst - 2nd Shift Professional Services Albany, New York Malta, New York Clifton Park, New York Menands, New York Syracuse, New York Watertown, Read more
Infotainment Certification Test Engineer (XC)...
…integration - CarPlay, android auto, MirrorLink, Baidu Carlife, MFi/iPod certification testing; Apple PPID preparation, Google HUCD and GTM preparation + 3 years of Read more
Workplace Services *Apple* Device Managemen...
…3350 Riverwood Parkway Suite 900, Atlanta, GA, 30339 USA **Workplace Services Apple Device Management** **Role Overview** Carrier is seeking an experienced and Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.