Disassembler

[RuudB]

Hallo,

NASM comes with a disassembler. But NDISASM simply disassembles everything that comes in its way, without any intelligence AFAIK. And worse, the output is a listing, not a source file ready to be assembled. Or am I doing something wrong?
If not, can anybody point me to a disassmbler producing (almost) ready to use source files, please?
The files that I want to disassemble are mainly (XT) BIOSes and smaller COM files.
Thank you very much for any info, URL or other help!

Met vriendelijke goret / kind regards, Ruud Baltissen
www.Baltissen.org

[Rob Neff]

See if Agner Fog's objconv program does what you want: http://www.agner.org/optimize/
I use that instead of ndisasm for 32/64 bit Windows objects files.  Not sure if it does 16-bit or not.

You can also try GNU objdump contained in binutils: http://www.gnu.org/software/binutils/
However, you'll need the mingw package if your doing this on a Windows machine: http://www.mingw.org/

[Frank Kotler]

Hi Ruud,

I'm really impressed by Agner Fog's "objconv":

http://www.agner.org/optimize/#objconv

However, it works with 32- and 64-bit object and executables for OMF, PE/COFF, ELF, and Macho formats. I don't think it will do anything useful with a .com file or a BIOS. Might be worth a try, and source code is available if you wanted to make a "project" out of it. If you've got anything to disassemble that it will work with, give it a try - I think you'll like it.

As you observe, Ndisasm doesn't even try to figure out what it's disassembling. Agner's "objconv" knows how to recognize and parse headers, to see where code starts, and data. It can pick out variable names, and even observe that "this lea esi, [esi + 0] is for alignment padding". Without a header, like a .com file or (I assume) a BIOS, there's a lot less information to work with. A bit of a paradox that a "simpler" file is more complicated to disassemble!

I've written a little program that blindly strips off the first 20(?) bytes of Ndisasm's output. In some cases, this will assemble. Not very useful - we had the binary! Something that could be modified and still reassemble (correctly) would be nice.

There used to be a thing called "sourcer" that would do it, and IDE Pro (there's a free trial version) but I don't think they produce Nasm syntax. Jeff Owens has a thing that will do it for ELF. I'm not familiar with what's available recently for dos/doze...

That's a long way of saying, "No, I don't know what would help you" I guess.

Anyone?

(again, I see Rob and I have posted at nearly the same time... )

Best,
Frank

[RuudB]

Hallo Rob, Frank,

Thank you both for your replies!

I'm really impressed by Agner Fog's "objconv"

I'll have a look at it.

There used to be a thing called "sourcer" that would do it

That's the one I'm using since the '80s. I still use it and wrote a program that converts its TASM output into NASM code.

and IDE Pro (there's a free trial version)

I assume you meant "IDA Pro". I downloaded it but it didn't work: I get all kind of error messages and then it quits (Windows 7, 32 bits).

Another option: I wrote an 'intelligent' disassembler that can disassemble 6502, Z80 and 6800 code. I call it intelligent because it can analyze the program a bit. You give it one or more start addresses and starts to follow code through jumps, branches and subroutines and keeping track of it. Unfortunately it isn't an emulator (yet) so it cannot handle indirect jumps if the source address is in RAM.
To make a long story short, I'm thinking about adding support for the 8086 as well. One good reason to do it: I think it will be fun to do it!

Met vriendelijke groet / kind regards, Ruud Baltissen
www.Baltissen.org

[RuudB]

I'm really impressed by Agner Fog's "objconv"

I'll have a look at it.

It seems that OBJCONV uses the first few bytes of a file to determine what kind of file it is dealing with. In this case it is dealing with the BIOS of a 1985 Commodore PC10 starting with 'FF FF F8 FF'. Result: error 2018. Trying to disable this error (and next ones) didn't help

Met vriendelijke groet / kind regards, Ruud Baltissen
www.Baltissen.org