8031 / 8085 disassembler? - Page 1
Forum section: electronics / general

author: metertech58761
author_rank: Frequent Contributor
timestamp: February 15, 2025, 10:54:16 pm
content: I could have sworn I posted about this recently but I cannot find the thread at the moment.I have about 10 EPROM dumps (half are for 8085, the rest are for 8031), and I haven't had much luck in finding a 'turnkey' tool that I can use to dump the code and start learning Intel assembly language (I'm only familiar with 68xx / 6502).I can see there are a bunch of tools available for download, but almost every single one, even Ghidra, apparently has to be compiled before they can be used.I don't know the first thing about compiling software to run on macOS or Windows. Where do I go from here?Unless someone has time to help me eventually create assembly dumps of these EPROMs...?

author: Dazed_N_Confused
author_rank: Contributor
timestamp: February 15, 2025, 10:57:05 pm
content: Quote from: metertech58761 on February 15, 2025, 10:54:16 pmGhidra does not have to be compiled for Windows, Linux, and possible MAC

author: metertech58761
author_rank: Frequent Contributor
timestamp: February 16, 2025, 12:33:27 am
content: I couldn't get it going under macOS, but I got it going on my Windows box (after downloading Java).I must be doing something wrong as it won't read the files properly. Guess I need to RTFM.(attachment is a zip of the dumps I wanted to disassemble - the 290077 file was the first one I tried)

author: PCB.Wiz
author_rank: Super Contributor
timestamp: February 16, 2025, 05:46:55 am
content: Quote from: metertech58761 on February 15, 2025, 10:54:16 pmIf you just want to learn, maybe loading the HEX into 8051 simulators would be better/easier. Many disassemblers are partial and do not manage relocating code well.Most simulators include disassemblers and you can step the code.I find this new one, web basedhttps://8051-simulator.vercel.app/but it seems to give errors ?others arehttps://edsim51.com/andhttps://www.ieap.uni-kiel.de/surface/ag-berndt/lehre/fpmc/index-e.htmletc

author: Whales
author_rank: Super Contributor
timestamp: February 16, 2025, 06:13:25 am
content: Some suggestions in this topic:https://www.eevblog.com/forum/microcontrollers/8051-disassembler/I didn't know SDCC came with a simulator. Sadly though my code tends to use extended STC8 peripherals, so it would probably not be much use for my stuff.

author: pcprogrammer
author_rank: Super Contributor
timestamp: February 16, 2025, 07:02:51 am
content: If you really want to learn do it by hand.This pdf holds a lot of information about the 8085https://bitsavers.trailing-edge.com/components/intel/MCS80/9800301D_8080_8085_Assembly_Language_Programming_Manual_May81.pdfStart at the reset vector and work your way through the code.For the 8051 there will be similar books on the net. I learned a lot when debugging 8051 code with a logic analyzer that only had the option to show hex data. This was more then 30 years ago though.

author: metertech58761
author_rank: Frequent Contributor
timestamp: February 17, 2025, 06:31:36 am
content: Tried out a few different tools and finally found one that makes a listing of the code as I wanted. I've attached two, and I just want to verify that they make sense.(I did convert all the raw dumps into Hex files along the way as that format seems to be preferred over the raw binary)Once I'm sure I have a good dump of the source, I can start analyzing and commenting it into a source file.On the subject of Hex files and disassembly, I do have a bit of trouble getting Bin2Hex to set the offset that is needed on some of the files.

author: m k
author_rank: Super Contributor
timestamp: February 17, 2025, 03:06:07 pm
content: 77 is wrong.Vector table is as it should, but code is not correct.Guessing that E3 is C3 and E9 is C9.Then E3 60 20 is jump to 2060 and E9(0030) is RET(C9), as it most likely should.Address 0004 can be a checksum.But jump address 2060 is probably also wrong, it's more likely 0040.So one data bit seems to be stuck.

author: metertech58761
author_rank: Frequent Contributor
timestamp: February 17, 2025, 04:56:31 pm
content: I was wondering about the code from the -77 board. Thank you for double-checking.I'm not entirely surprised I got a bad read, given the condition of the board (it came out of some industrial equipment and has some acid fume exposure).I'll dig out the board and re-read the EPROM (after cleaning the leads).Anyway, I'm currently analyzing the -55 EPROM as it only uses half its allocated space.I see the vector table (RST 0 and all four hardware vectors), I just determined the odd two bytes at the very end are some kind of constant, and I'm currently working out the memory map.

author: bobxyz
author_rank: Contributor
timestamp: February 17, 2025, 05:50:59 pm
content: Ghidra does really well for 8051 disassembly, but it's pretty complicated and the help/tutorials are aimed more at modern 32bit processors with high level languages. Ghidra does have a 8051 emulator included, but documentation is poor and the processor model doesn't correctly handle some of the weird 8051 instructions (like modifying a register by using a pointer to the memory mapped register shadow location).As a quick start for running Ghidra under windows, try:- download latest version fromhttps://github.com/NationalSecurityAgency/ghidra/releases- follow installation (aka unzip) instructions, you'll also need a JDK but don't need the python stuff for basic operations- go to the ghidra directory and double click on ghidraRun.bat- create a new project under your documents\ directory, or wherever you like- under File, select ImportFile, point it to your .bin file, and select the language (8085, or the 8051 default/default version)- double click on the .bin file to launch the CodeBrowser tool- say Yes to the auto-analyze prompt and use the default selections- click on code line 0000 (the 8031 reset vector) then type a "d" to disassemble- click on the other main 8031 vectors (0003,000b,0013,001b,0023,002b) and type a "d". If it doesn't look like reasonable assembly code, do a <Ctrl-Z> to undo- to save an ascii listing, select File-->ExportProgram, select Ascii, point it to your desired directory, click OKExample results for your 290078 8031.bin file are attached.

author: Whales
author_rank: Super Contributor
timestamp: February 17, 2025, 07:39:24 pm
content: Other pros of Ghidra:- Shows a guessed decompilation of each function to C. Very useful for lazymen like me that want to work on any cpu architecture at any time without knowing lots about them.- Lets you rename variables, functions and data; which then get renamed everywhere in every reference.

author: metertech58761
author_rank: Frequent Contributor
timestamp: February 18, 2025, 01:08:59 am
content: Sure enough! I just re-read the 290077 EPROM and bit 5 was stuck. I whipped up a new HEX file and corrected dump is attached.I also need to go back and re-read the 290055 EPROM and re-validate the pin connections to the '138 on the board.The code I have in front of me is missing calls to the serial interface IC and the data buffers, so I think that code came up bad as well.(edit: no, it seems to be fine. Will have to focus on revalidating my schematic)I read both with the GQ-4X programmer I have, I'm doing these updated reads with my TL-866.

author: m k
author_rank: Super Contributor
timestamp: February 19, 2025, 02:35:00 pm
content: Change labels to absolute addresses.The current system is very stupid.And learn that Ghidra, it is actually pretty good.OpenJDK is available for Mac.It's a runtime, so standalone fileset is enough, no installation needed.This current disassembler of yours is single pass.Its problem is that it can't recognize data areas.

author: metertech58761
author_rank: Frequent Contributor
timestamp: February 19, 2025, 09:59:41 pm
content: Yes, once I get an understanding what various calls do, then I will start naming them appropriately.Thanks for the tip on OpenJDK, will check it out in a bit.Yes, I have a feeling that there are data tables in the code - even though Intel assembly is Greek to me (compared to my overall understanding of 65xx / 68xx), I have spotted a few instructions that don't make sense at first glance, unless they're just there to burn a few cycles (i.e., MOV A,A).I've also noticed that some of the operands have an extra 0 in front of them - like 0A0h (whereas I'm more accustomed to thinking $A0). Is that typical for Intel assembly?

author: xvr
author_rank: Frequent Contributor
timestamp: February 20, 2025, 12:43:27 pm
content: QuoteYes. Numbers (in any radix) should starts with digit, to distinguish them from identifies. So hex numbers starting from A-F will have '0' as first digit.

author: metertech58761
author_rank: Frequent Contributor
timestamp: February 21, 2025, 06:30:01 pm
content: So I toned out the 290055 board again and I have the schematic correct, but I'm still not seeing how some functions get called.U6 in the attached schematic selects various functions depending on the current address value, but I see no calls higher than the 6xxx address range?0000-1FFF: ROM2000-3FFF: RAM4000-5FFF: U2 (8155 #2)6000-7FFF: U1 (8155 #1)8000-9FFF: CS1 on U15A000-BFFF: CS2 on U15C000-DFFF: CS3 on U15E000-FFFF: Data bus buffer

author: bobxyz
author_rank: Contributor
timestamp: February 21, 2025, 07:56:46 pm
content: The 8085 has a "Memory-Mapped I/O" mode where the 8-bit port address is output on the upper 8 address bits. I'd rummage through code to see if there are any port accesses to ports 128-255, and see how the IO/M signal is wired up to the peripheral chips.See:http://www.bitsavers.org/components/intel/MCS80/MCS80_85_Users_Manual_Jan83.pdf

author: metertech58761
author_rank: Frequent Contributor
timestamp: February 21, 2025, 09:43:22 pm
content: Sure enough! There are a bunch of IN and OUT statements - I was wondering how those statements worked.So, in other words, the Intel IN / OUT statements are in a sense identical to the (Indirect), Y mode in the 6502, correct?

author: m k
author_rank: Super Contributor
timestamp: February 23, 2025, 08:36:53 am
content: No, with indirect indexed addressing you can control both parts.8085 IN and OUT duplicates the high part from the low part.8085 is also generally quite limited to what comes to addressing modes.But everything can be circumvented with some extra code.Serial controller doesn't have any IO/_M signal, so it takes them both.A0 goes to C/_D so bit 0 for I/O address should be easy to spot.For bus data and serial controller there are still that 8085 indirect style (HL) and XCHG swapper.

author: metertech58761
author_rank: Frequent Contributor
timestamp: March 03, 2025, 05:36:21 am
content: Small update.I still don't know what I'm doing as far as Ghidra goes, but I eventually found a different tool (can't recall its name offhand, but it was an evaluation copy) through which I was able to make proper disassembly dumps of the three 8085-based boards (-51, -55, and -77).The -55 board was fairly straightforward to work out the memory map, but I'm not as confident with the -51 and -77 boards.On the 8085, I assume you can have different memory layouts based on the state of the IO/M line?Then on the boards with the 8031 MPU, I likewise found a disassembly tool (D52) through which I was able to generate dumps of the EPROMs for the -22 and -78 boards (although I don't know yet if there are data tables in the code).The last two I need to work out the proper assembly format for string data - there are strings of text that get written to the LCD and which uses 00 as an end marker...