TweetFollow Us on Twitter

Disassembler
Volume Number:1
Issue Number:6
Column Tag:MacNosy

A New Disassembler

By Steve Jasik

A New Disassembler

As a compiler writer specializing in code generation, I decided to build a Disassembler to better understand the Motorola 68000 and the Macintosh operating system. Given the poor quality of the documentation and the general lack of source listings, a powerful disassembler is a useful tool for debugging and getting information about the system.

MacNosy and its helper programs consist of over 7000 lines of Pascal and about 300 lines of assembly lanaguage code. Internally, MacNosy contains many features usually associated with a compiler such as a table manager, symbol table enter/lookup routines, a reference map, global flow analysis, etc.

Features

MacNosy has many features that place it an order of magnitude above other disassemblers. They include:

• Symbol dictionaries of the Rom names and global symbols (0 - $B00) along with value to symbol substitution in appropriate places.

• Selective list of procedures in a file by procedure name or substring.

• Ability to place the disassembled output on a file in assembler listing output or assembler input format (MDS “.list” or “.asm” format).

• References to the symbols are collected and may be selectively viewed.

• Ability to search the program file for references to selected address’s, trap (rom) calls, resource type references, constant or string references.

• Ability to translate the segment relative address of an instruction to the disk file relative address for code patching purposes.

• MacNosy records its input on a “.jrnl” file (in text format) for later playback. This feature is used as an educational tool and as a medium of communication between developers, hackers, etc.

• Ability to reformat data in its “natural format” via directives. This is in addition to the automatic recognition of various character string formats.

• A full or selective listing of the resources in a file. Format is similar to that of the Resource Mover, but you get more information with less work.

• A built-in mini editor to view files without leaving Nosy.

Facts and Specifications

MacNosy runs on a 512K Mac or a 1 Meg Lisa under the Workshop O.S. or the Macworks environment.

It is capable of disassembling the resource fork of any application file, ROM, Macsbug, and various resource types in the System file (DRVR, PACK, INIT, CDEF, WDEF, etc). Note that source listing of the WDEF, CDEF procedures come with the MacSupplement.

The released disk contains both the Mac and Lisa versions of MacNosy, some sample “.jrnl’ files to acquaint you with it, source code for the table manager (this may be useful to other developers) and the SfGetFile routines so you can see how it selects files to disassemble.

How does MacNosy work?

When disassembling a file, one must know the structure (code or data) of a given piece of the file. To do this, Nosy uses the fact that every program has a “call graph”. The nodes of the graph are the procedures and the edges are the calls (A calls B, etc). As Nosy is primarily interested in the size of the nodes, it ignores some aspects of the graph (such as recursion) which leads to cycles in the graph. Because of this, the graph reduces to a Directed Acyclic (without cycles) Graph. We can get sloppy in our terminology and refer to the DAG as a “tree of procedures”.

Discovering the size and extent of a procedure is a messy problem that entails disassembling instructions, and looking for the procedure exits. The potential presence of spaghetti code makes the algorithm more complicated.

At this point a reasonable strategy is to treat the file as a collection of code and data blocks (contigious set of bytes). We start at the entry points and walk the tree until all possible procedures have been discovered. The remaining areas are caterogized as “data” blocks. During the tree walk Nosy builds symbol tables for the various categories of labels which are:

Procedure (JSR X) X = proc’nnn’ or the 8 character name following the proc if compiled by Lisa Pascal with the D+ option on.

Global labels ( X(A5) )

X = glob’nnn’

Data labels (LEA X or PEA X)

X = data’nnn’

Common labels (JMP X, Bcc X from another proc) - com_’nnn’

Local labels within a procedure - loc_’nnn’

You can change the names of all but the local labels in Nosy.

Example 1 - A fragment of the resource list of a System file.

Note that for the DITL’s the accompanying text/controls are listed.

      26 resource types, data index =   100
Type FRSV    att   indx  length   name
  ID     1     00   CF12        A        0      0
Type ALRT    att   indx  length   name
  ID  -3997   20   CDBC       C        0        0
  ID  -3996   20   CDCC       C        0        0
  ID  -3995   20   CDDC       C        0        0
  ID  -3994   20   CDEC       C        0        0
Type DITL    att   indx  length   name
  ID  -15936  20   BA6C      1E    
  ID   -6047  20   CA18     1A6    <Initialize> <Eject> <OK> 
                               Do you want to initialize it? 
                               This disk is unreadable: 
                                This disk is damaged: 
                               This is not a Macintosh disk: 
                               Please name this disk: 
                               Initializing disk . . .  
                               Initialization failed! 
                               Initialize this disk? 
  ID   -4000  20   CC7C      A8    <Open> <O> <Cancel> <Eject> <Drive> 
h 
  ID   -3999  20   CD28      90    <Save> <Cancel> Save as: <Eject> <Drive> 

Example 2 - code fragment from a little test program I wrote.

The output listing format is:

aaa: hhhh hhhh ‘cccc’ label opcode address $ssaaaaaa

aaa = segment relative address , hhhh and ccccc are the value of the instruction in hex and ascii. The field ssaaaaaa is the address of any label or symbol reference in the

address field. ss is the segment number of the reference.

I have suppressed leading zeros in most cases and many of the numeric formats use decimal conversion. The macros POP and PUSH have the obvious meaning. The QUAL pseudo implies that all the labels of the form loc_nnn are local to the procedure. The line right after it tells us who calls it. The line with “_Button” is a trap macro. The DNAME macro expands to the 8 character name which is used by Lisabug and Nosy.

    440:                                 QUAL    CHK_USER
                                ; refs - TEST  
    440:                                  
    440: 4E56 0000      ‘NV..’  CHK_USER LINK    A6,#0
    444: 4267           ‘Bg’             CLR     -(A7)
    446: A974           ‘.t’             _Button 
    448: 101F           ‘..’             POP.B   D0
    44A: 6714           ‘g.’             BEQ     loc_2               
      $1000460
    44C: 2F0E           ‘/.’             PUSH.L  A6
    44E: 4EBA FFC0      ‘N...’           JSR     WAITBUTT            
      $1000410
    452: 4267           ‘Bg’    loc_1    CLR     -(A7)
    454: A974           ‘.t’             _Button 
    456: 101F           ‘..’             POP.B   D0
    458: 67F8           ‘g.’             BEQ     loc_1               
      $1000452
    45A: 2F0E           ‘/.’             PUSH.L  A6
    45C: 4EBA FFB2      ‘N...’           JSR     WAITBUTT            
      $1000410
    460: 4E5E           ‘N^’    loc_2    UNLK    A6
    462: 4E75           ‘Nu’             RTS     
    464:                                  
    464: C348                   data21   DNAME   CHK_USER,0,2

Example 3 - This next routine was dumped to the hardcopy file in “.asm” format.

It is suitable for input to the MDS assembler ASM.

         QUAL    WCR
; refs - TEST 
          
WCR      LINK    A6,#0
         PUSH.L  glob13(A5)
         PEA     data19
         CLR     -(A7)
         JSR     %W_STR
         PUSH.L  glob13(A5)
         JSR     %W_LN
         PUSH.L  glob12(A5)
         PEA     glob8(A5)
         PUSH    #255
         JSR     %R_STR
         PUSH.L  glob12(A5)
         JSR     %R_LN
         UNLK    A6
         RTS     
          
data18   DNAME   WCR     ,0,2
          
; refs - WCR+8  
data19   STR     ‘wait for cr’

Example 4 - Note the Value to Symbol substitution in this ROM fragment listing

 404C12: 50F8 0902      ‘P...’  Launch   S_T     LaunchFlag          
      $902
 404C16: 31E8 0004 0936 ‘1....6 loc_2    MOVE    4(A0),CurPageOption 
      $936
 404C1C: 2058           ‘ X’             MOVE.L  (A0)+,A0
 404C1E: 43F8 0910      ‘C...’           LEA     CurApName,A1        
      $910
 404C22: 7020           ‘p ‘             MOVEQ   #32,D0
 404C24: A02E           ‘..’             _BlockMove  

Example 5 - Sample Reference Map listing fragment of the “System Globals” from ROM

      114 HeapEnd      proc203  MaxMem  proc253  
      118 TheZone      proc201  proc203  GetZone  MaxMem  proc212  proc232 
 
                       InitResources  proc852  MoreMasters  InitZone 
 proc204  
                       SetGrowZone  
      11C uTableBase   proc36  proc89  proc96  RDrvrInstall  SystemTask 
 proc942  
                       SystemMenu  OpenDeskacc  BlockMove  com_28

Example 6 - Sample Segment Reference Map listing fragment of Nosy.

Inter seg refs are prefixed with “n/”. This map may be used for procedure balancing.

seg# procedure   fba  blen  refs (seg#/proc) called by
  1] HEAP_OVF    1D6    50   ADD_USED    4/NEW_TBL    
  1] SET_MAX     208   120   CLR_TBL     4/REL_TBLS    3/RTN_PTR    
  1] CLR_TBL     280    46   DI_PROC     3/SEARCH_C    4/DI_FILE     
3/SEARCH_C   
  1] MOVEUP      2AE    80   ADD_USED   
  1] ADD_ENTR    2FE    42   DI_PROC       ENTER_LA      PUT_REF     
  NEW_CASE   
                             ADD_ISPR    3/CHK_PROC    4/NI_FILE     
4/DI_FILE    
                             PROCESS_   
  1] SET_USED    328    44 4/NI_FILE    

Disassemblling the ROM

I Would like to show a sample listing of a piece or two of ROM but I don’t want to start any fights with Apple’s Lawyers. So like sex, I leave it for you to do it in the privacy of your own home.

I found a few interesting things looking around the ROM. One is an interesting piece of unreachable code at 40AD30 which blasts 32 long words into RAM and then hangs. Another is the “come from” code in the rom patch area in the system heap. In many cases bugs were patched by placing a CMPI.L $40xxxx,28(A7) followed by a suitable jump in unrelated routines. A rather obnoxious example is BlockMove which contains 3 such checks. I will be forming a MacNosy Users Group (Special Interest Group) on the Delphi Information Service (800-544-4005) starting in April to study the ROM and swap “jrnl” files. Admission will be limited to registered owners of MacNosy.

Ordering Information

If ordered from the author before May 1, 1985 cost is $55, including sales tax for CA. residents. After that it will be sold in selected stores or direct for $70. Orders should be addressed to:

Steve Jasik

343 Trenton Way

Menlo Park, Ca. 94025

(415-322-1386)

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Trend Micro 11.0.2062 - An essential sec...
Trend Micro Antivirus provides essential security for macOS with real-time malware detection and mitigation in an affordable solution with a simple, intuitive interface. However, be aware that more... Read more
Backblaze 7.0.2.490 - Online backup serv...
Backblaze is an online backup service designed from the ground-up for the Mac. With unlimited storage available for $6 per month, as well as a free 15-day trial, peace of mind is within reach with... Read more
Pro Video Formats 2.2.1 - Updates for pr...
Pro Video Formats includes support for the following professional video codecs: Apple Intermediate Codec Apple ProRes AVC-Intra 50 / 100 / 200 / 4:4:4 / LT AVC-LongG XAVC XF-AVC DVCPRO HD HDV XDCAM... Read more
Boom 3D 1.3.11 - $19.99
Boom 3D is a revolutionary app with 3D Surround Sound and phenomenally rich and intense audio that is realistic and works on any headphones. Features 3D surround sound Built-in audio player... Read more
Final Cut Pro 10.5.2 - Professional vide...
Redesigned from the ground up, Final Cut Pro combines revolutionary video editing with a powerful media organization and incredible performance to let you create at the speed of thought.... Read more
Chromium 89.0.4389.72 - Fast and stable...
Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all Internet users to experience the web. Version 89.0.4389.72: Complete list of changes can... Read more
iMovie 10.2.3 - Edit personal videos and...
With a streamlined design and intuitive editing features, iMovie lets you create Hollywood-style trailers and beautiful movies like never before. Browse your video library, share favorite moments,... Read more
OmniPlan 4.2.5 - Professional-grade proj...
With OmniPlan, you can create logical, manageable project plans with Gantt charts, schedules, summaries, milestones, and critical paths. Break down the tasks needed to make your project a success,... Read more
Compressor 4.5.2 - Adds power and flexib...
Compressor adds power and flexibility to Final Cut Pro X export. Customize output settings, work faster with distributed encoding, and tap into a comprehensive set of delivery features. Features:... Read more
Motion 5.5.1 - Create and customize Fina...
Motion is designed for video editors, Motion 5 lets you customize Final Cut Pro titles, transitions, and effects. Or create your own dazzling animations in 2D or 3D space, with real-time feedback as... Read more

Latest Forum Discussions

See All

Frogger in Toy Town's latest update...
Konami Digital Entertainment has announced today that their Apple Arcade title Frogger in Toy Town has been updated to introduce a new ranked Endurance Mode. This new game variant's arrival is also accompanied by a few other changes. [Read more] | Read more »
Mitoza is surreal adventure toy you can...
The folks behind the Rusty Lake games have just put a new title onto the App Store. Second Maze, Rusty Lake's collaborative publishing brand, has just brought this 10 year old adventure game from Gal Mamalya to mobile. The best part about all of... | Read more »
Pocket Gamer Awards 2021: You have five...
Three weeks ago our sister site, Pocket Gamer, entered the voting stage for the upcoming Pocket Gamer Awards 2021 and is now in the final stretch. You only have a few hours left to vote for the games you’ve enjoyed on mobile in the past year, as... | Read more »
Patty Stack is a casual arcade game, ava...
Patty Stack is a casual arcade title that's available now for iOS and Android. It's the debut game from developer Feeka Games tasks players with making an increasingly giant burger tower. Think of it as Tower Bloxx but more edible. [Read more] | Read more »
Distract Yourself With These Great Mobil...
There’s a lot going on right now, and I don’t really feel like trying to write some kind of pithy intro for it. All I’ll say is lots of people have been coming together and helping each other in small ways, and I’m choosing to focus on that as I... | Read more »
Genshin Impact Guide - Gacha Strategy: W...
This is part 2 of our Genshin Impact gacha strategy guides. See part 1 here. You can check out more guides for Genshin Impact here. | Read more »
Slashy Camp is a new endless runner insp...
Blue Wizard Digital has released Slashy Camp onto iOS and Android after it spent a short amount of time in early access. [Read more] | Read more »
Kinder World is a relaxing game about lo...
Lumi Interactive is releasing a game called Kinder World later this year on iOS and Android, which is all about looking after houseplants. [Read more] | Read more »
Steam Link Spotlight - Fights in Tight S...
Steam Link Spotlight is a feature where we look at PC games that play exceptionally well using the Steam Link app. Our last entry was on Hades. Read about how it plays using Steam Link over here. | Read more »
Lyxo, the light-based puzzler for mobile...
Vienna-based independent game studio Emoak has just released its unique light-based puzzler for iOS and Android. Founded in 2014 by Tobias Sturn, the company is also the creative force behind the infinite climbing game Paper Climb, as well as the... | Read more »

Price Scanner via MacPrices.net

Weekend Sale: $100 off Apple iPad Magic Keybo...
Amazon has Apple iPad Magic Keyboards on sale for $100 off MSRP for a limited time. Amazon’s prices are the lowest available for iPad Magic Keyboard from any Apple reseller this weekend: – Magic... Read more
Gazelle now offering a full line of refurbish...
Gazelle is now offering a full range of discounted, refurbished, unlocked Apple iPhone 12 models starting at $649. iPhones are offered in Fair, Good, and Excellent conditions, and multiple colors are... Read more
These are the latest discounted iPhones Apple...
Apple has a range of Certified Refurbished iPhones available right now starting at only $339. Apple includes a standard one-year warranty, new outer shell, and shipping is free. According to Apple, “... Read more
Save up to $64 on new M1 MacBook Airs at Expe...
Apple reseller Expercom has 2020 13″ M1 MacBook Airs on sale for $51-$64 off Apple’s MSRP with prices starting at $947.96. In addition to their MacBook Air sale prices, take $50 off AppleCare+ when... Read more
Discounts available on 16″ MacBook Pros with...
Upgrade a 16″ 6-Core or 8-Core MacBook Pro from 16GB of standard RAM to 32GB at Adorama, and save $100-$210 over Apple’s price for this custom option: – 16″ 6-Core MacBook Pro/32GB RAM: $2699, save $... Read more
10.9″ iPad Airs on sale for $50-$70 off Apple...
Amazon has new 2020 10.9″ Apple WiFi iPad Airs in stock and on sale today for up to $70 off MSRP with prices starting at $549. Note that Amazon’s sale price might be restricted to certain colors (see... Read more
Apple restocks 2020 27″ 5K iMacs for up to $3...
After an initial offering in January, Apple has restocked a full line of Certified Refurbished 2020 27″ 5K iMacs starting at $1529 and up to $350 off original MSRP. Apple’s one-year warranty is... Read more
Sale! 16″ 8-Core MacBook Pro for $2449, $350...
Apple reseller Adorama has the 16″ 2.3GHz 8-Core Space Gray MacBook Pro in stock and on sale today for $2449 including free shipping. Their price is $350 off Apple’s MSRP for this model, and it’s the... Read more
Roundup of 13″ Multi-Core Intel MacBook Pro s...
Apple resellers are offering significant sales & deals this week on 2020 13″ MacBook Pros with 10th generation Intel CPUs. Take up to $250 off Apple’s MSRP, get free fast shipping, and/or pay no... Read more
64GB iPhone 8 Plus available for $379 at Appl...
Apple has the 64GB iPhone 8 Plus in Space Gray & Gold colors available for $379 today, Certified Refurbished. Each phone is unlocked and comes with Apple’s standard 1-year warranty and free... Read more

Jobs Board

Geek Squad Advanced Repair *Apple* Professi...
**795178BR** **Job Title:** Geek Squad Advanced Repair Apple Professional **Job Category:** Store Associates **Store Number or Department:** 001406-Allen Park-Store Read more
Geek Squad *Apple* Consultation Professiona...
**796549BR** **Job Title:** Geek Squad Apple Consultation Professional **Job Category:** Store Associates **Store Number or Department:** 001800-Hot Springs-Store Read more
*Apple* Mobility Specialist - Best Buy (Unit...
**796014BR** **Job Title:** Apple Mobility Specialist **Job Category:** Store Associates **Store Number or Department:** 001776-Woodmore Towne Centre-Store **Job Read more
Systems Architect, *Apple* Production Engin...
…package beginning on your first day? If so, we hope you'll keep reading! The Apple Sales Engineering and account team is looking for a stellar presales engineer with Read more
Systems Engineer, Webscale, *Apple* Retail,...
…beginning on your first day? If so, we hope you'll keep reading! The Apple Sales Engineering team is looking for a pre-sales engineer with Enterprise engineering Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.