Tiny disassembler and IDA processor modules for microcontroller - Page 1
Forum section: electronics / projects

author: stfsux
author_rank: Contributor
timestamp: January 22, 2017, 03:24:08 pm
content: Hi,I'm currently working on a tiny disassembler and IDA processor modules for microcontroller.I'm a bit lazy so I'll paste the README here.udasmTiny disassembler for microcontrollers with configurable memory map. Most ofexisting disassemblers for microcontrollers are either a part of binutils or IDAprocessor modules with a static memory map. In other words, you usually haveeither to recompile the processor module or use a third-party script thathandles internal registers. Thanks to libconfig, with udasm you can easly writeyour own memory map with a single configuration file and without recompiling thewhole s**t.Supported architectures- Intel 8051- ATMEL AVR 8(16)-bitSupported file format- BinaryMemory map configurationMemory map configuration contains 2 main parts.One that defines all specific code location such as interruptions.And the other one that defines all internal registers mapped in memory.To specify an interruption in the memory map configuration file you haveto define a global variable named CODE where you can list all interruptionsin a variable named 'interrupts'.Each interruption has the following format: ( "name", offset, size, "type" ).- name: quoted string holding the name of the interrupt.- offset: location of the interrupt in the firmware.- size: size in byte of the interrupt.- type: quoted string defining the type of the interrupt.- data: the location is an address of the routine (e.g. isr vector table in arm cortex-m). Currently not fully supported.- code: the location is a routine (e.g. most of avr/i8051/etc. usually containing an absolute jump to the routine).Internal registers mapped in memory can be defined in a global variable name 'IDATA' and listedin variable named 'map'. Each element of this list may contain the following variables:- page: memory page which contains the internal registers.- busid: an architecture specific id for some instructions that use an other memory map layout.E.g. in some AVR, memory operand of in/out instruction might have an implicit offset from the physical memory layout. lds r0, 0x0020 is the same shit as in r0, 0x00.- registers: an array of 2 elements, a quoted string of the register's name and a location.- bits: an array of 2 elements, a quoted string of the bit's name and a location.See xmega128a1.cfg as an example.Architecture specific- AVR- busid: 0x01 for in/out memory operand.IDA procmod- Intel 8051- ATMEL Avr 8(16)-bitTODO-doneAdd listview with all internal registers.-doneAdd xref for each internal register.-doneIDA procmod for avr.- PIC architecture.- Ability to define global variables in the memory map configuration file.- IDA procmod- select a different page for a specific memory operand in disassembly.Using IDA procmod- Load a new memory map configuration file- File -> Load file -> Load new memory map...- Show all internal registers- View -> Open subviews -> Internal registers- Show all internal bit registers- View -> Open subviews -> Internal bit registers- Show all interruptions- View -> Open subviews -> List of interruptions- Show all xref(s) to an internal register- Double click on that item in the list of internal registersIDA procmod screenshotAny comment(s) or suggestion(s) would be appreciate.

author: stfsux
author_rank: Contributor
timestamp: May 18, 2017, 12:30:36 pm
content: Hi,A little update.READMECode:udasm=====Tiny disassembler for microcontrollers with configurable memory map. Most ofexisting disassemblers for microcontrollers are either a part of binutils or IDAprocessor modules with a static memory map. In other words, you usually haveeither to recompile the processor module or use a third-party script thathandles internal registers. Thanks to libconfig, with udasm you can easly writeyour own memory map with a single configuration file and without recompiling thewhole shit.The standalone disassembler in command line uses ANSI escape codes in order toprint colorized assembly. On windows it's not supported but there are still someemulators which support ANSI escape codes (such as ConEmu, PowerShell, etc.).libudasm--------There is currently no documentation.Supported architectures------------------------ Intel 8051- ATMEL AVR 8(16)-bit- Microchip PIC high-end core devicesSupported file format---------------------- BinaryMemory map configuration------------------------Memory map configuration contains 2 main parts. One that defines all specificcode location such as interruptions. And the other one that defines all internalregisters mapped in memory.To specify an interruption in the memory map configuration file you have todefine a global variable named CODE where you can list all interruptions in avariable named 'interrupts'.Each interruption has the following format: ( "name", offset, size, "type" ).- name: quoted string holding the name of the interrupt.- offset: location of the interrupt in the firmware.- size: size in byte of the interrupt.- type: quoted string defining the type of the interrupt.- data: the location is an address of the routine (e.g. isr vector table in ARMcortex-m).- code: the location is a routine (e.g. most of avr/i8051/etc. usuallycontaining an absolute jump to the routine).Internal registers mapped in memory can be defined in a global variable name'IDATA' and listed in variable named 'map'. Each element of this list maycontain the following variables:- bank: memory bank which contains the internal registers.- busid: an architecture specific id for some instructions that use an othermemory map layout. E.g. in some AVR, memory operand of in/outinstruction might have an implicit offset from the physical memorylayout. lds r0, 0x0020 is the same shit as in r0, 0x00.All registers with a busid not equal to zero are not listedin IDA procmod since they are just mapped differently.- registers: an array of 2 elements, a quoted string of the register's name anda location.- bits: an array of 2 elements, a quoted string of the bit's name and alocation.See xmega128a1.cfg as an example.You can also define all global variables in a separate configuration file.This one should only have a list of all variables listed in 'global_variables'with the following format: ( "name", address ).- name: quoted string holding the name of the variable.- address: the location in RAM of this variable.See variables-test.cfg as an example.Architecture specific---------------------- AVR- busid: 0x01 for in/out memory operand.- PIC18- busid. 0x00: Unbanked memory region (e.g. movff 0x1234,0x5678).. 0x01: banked memory region (e.g. movfw 0x12, W, 1)Compile-------WindowsBefore running nmake you must setup directories in dir.nmake.Then type:nmake /f makefile.nmakeBy default it assumes you're compiling in x32.You can force to compile in x64 by typing:nmake /f makefile.nmake UDASM_ARCH=x64GNU/LinuxType:make -f makefile.gmake*BSDFuck off.MacAhAHHAhGhgaHgahAGhAgagahaghGAHGGHAhAGHAGhAGHhAmigaType:AMIGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA!TODO----- 68HC08 (m6805) and derrivate architectures.- Support global variable configuration file for the commandline interface.IDA procmod PORN----------------IDA Screenshit: preview.png- Load a new memory map configuration file- File -> Load file -> Load new memory map...- Show all internal registers- View -> Open subviews -> Internal registers- Show all internal bit registers- View -> Open subviews -> Internal bit registers- Show all interruptions- View -> Open subviews -> List of interruptions- Show all global variables- View -> Open subviews -> Global variables- Show all xref(s) to an internal register/variable- Double click on that item in the listview- Unload variable/memory map configuration- File -> Load file -> Load new memory map...Then click Cancel or no (depends what you want to unload).Release-------. cfg/test.cfg: a random memory map file for test.. cfg/xmega128a1.cfg: a complete memory map file for avr xmega128a1.. cfg/pic18f4550.cfg: a complete memory map file for PIC18F4550.. mcu8051.w32: i8051 procmod for IDA 6.6. mcuavr8.w32: avr 8(16)-bit procmod for IDA 6.6. mcupich.w32: pic high-end core devices procmod for IDA 6.6. udasm.exe: standalone disassembler in command lineCHANGELOGCode:CHANGELOG=========- ??/??/????.  Add listview with all internal registers..  Add xref for each internal register..  IDA procmod for avr..  PIC high-end core devices architecture..  Ability to define global variables in a separate memory mapconfiguration file..  Show read/write mode in the xref list of internal registers..  Clean all global name before reloading a new memory map..  Close all opened choose2 dialog box before reloading a new memorymap..  avr8: brlt instruction was missing..  mmap: null pointer check before access.  Rename all symbols that are not specific to the correspondingarchitecture (e.g. mcuavr8_xref_something to xref_something)..  Replace the keyword "page" by "bank" just because.- 18/05/2017.  Rename the whole shit "libmcu" to "libudasm"..  x64 support (without ida proc mods of course).Nmake makefile provided to compile libconfigfor x64/32. Check tools/libconfig-1.5 folder.Run nmake /f makefile.nmake UDASM_ARCH=x64..  version 0.0.002 to 0.0.003

author: abyrvalg
author_rank: Frequent Contributor
timestamp: May 18, 2017, 02:00:23 pm
content: What is the difference from i51.cfg and avr.cfg files of IDA?

author: r0d3z1
author_rank: Regular Contributor
timestamp: May 17, 2018, 12:37:08 pm
content: Interesting, is it still an active project ?