(Link to AcmlmWiki) Offline: thank ||bass
Register | Login
Views: 13,040,846
 Main | Memberlist | Active users | Calendar | Chat | Online users
Ranks | FAQ | ACS | Stats | Color Chart | Search | Photo album 		04-29-24 11:58 AM
0 users currently in ROM Hacking.
Acmlm's Board - I3 Archive - ROM Hacking - Ok, how about clean room disassembly of Lunar Magic? New poll | |
Pages: 1 2 3Add to favorites | Next newer thread | Next older thread
User Post
Parasyte +

Red Paragoomba


 





Since: 01-05-06

Last post: 6600 days
Last view: 6600 days
Posted on 02-11-06 12:29 AM Link | Quote
I agree.
I have been writing a recompiler to service that very need. (I have not worked on it in about a year or longer, but it is mostly functional.) Long story short, it's a disassembler which intelligently follows code flow using recursion in an attempt to seperate code from data, as well as watching the register sizes. Though very incomplete, it has very great success locating jump tables and following those pointers. A lot is still missing, such as label logging and indirect jumps (it can't dereference indirect jumps that pull a pointer out of RAM yet) but it's functional enough for a proof of concept.

Any way, getting a 'clean' disassembly that can be recompiled is the easy part. The hard part is documenting all of the code to figure out what does what. And no one has released a completed version of the easy part, to my knowledge.
MathOnNapkins

1100

In SPC700 HELL


 





Since: 11-18-05

Last post: 6279 days
Last view: 6279 days
Posted on 02-11-06 01:11 AM Link | Quote
(it can't dereference indirect jumps that pull a pointer out of RAM yet)

This is something that has plagued me for a long time. I don't see how it could ever be achieved accurately unless you were logging it via an emulator. That doesn't even take into account things like PEA and RTS x 2, which can be used like JSR and RTS. I've also seen Jump Tables that occur directly after a JSL instruction. i.e. the JSL does not return directly to the next piece of code.

Example:

LDA $55 ; This would be the index of the routine to use.

JSL tableloader
; tableloader would use the value of A as an index to set up a JML
; to the routines in example_table (which immediately follows the JSL in the binary!)

example_table:

dw routine1
dw routine2
dw routine3
dw routine4

I've also seen jump tables that were "interlaced." In particular I had three different subroutines pulling pointers from one block of data. It was laid out like this:

example2_table:

; routinex_y means that x is the routine retrieving the pointer, and y is the designation
; of which pointer it is relative to routine x.

dw routine1_1, routine2_1, routine3_1
dw routine1_2, routine2_2, routine3_2
dw routine1_3, routine2_3, routine3_3

So given the flexbility of the 65816 to execute code I'd really like to hear more about how you plan to map out these types of behaviors. (indirect jumps, stack manipulation, and interlacing)
LocalH

Paragoomba


 





Since: 11-20-05

Last post: 6518 days
Last view: 6518 days
Posted on 02-11-06 03:56 AM Link | Quote
Perhaps one could combine a logging emulator backend with a comprehensive disassembler frontend? It's still going to be a lot of manual work, but this will at least aid in discerning code from data and making sure that the code is properly disassembled based on it's context. For example, if a particular opcode is ambiguous, one could merely enter a mode where the ROM is executed until said opcode is encountered, and then you have context. But definitely, one should aim to catch as much as possible with the disassembler, leaving the emulator to fill in the holes.
Parasyte +

Red Paragoomba


 





Since: 01-05-06

Last post: 6600 days
Last view: 6600 days
Posted on 02-11-06 06:30 AM Link | Quote
It already handles stack manipulation with recursion. Jump tables containing additional data would be a special case. You would have to keep track of the path taken to reach the jump instruction in question so that it could be traced over more than once (in hopes of getting a different index) Same for indirect jumps which access RAM. Who knows how many pointers could be loaded into the location? Perhaps a label logger could be used to help find all of the tables used to set it.

Otherwise, there's not much left to do until it is "fully functioning".
HyperHacker

Star Mario
Finally being paid to code in VB! If only I still enjoyed that. <_<
Wii #7182 6487 4198 1828


 





Since: 11-18-05
From: Canada, w00t!
My computer's specs, if anyone gives a damn.
STOP TRUNCATING THIS >8^(

Last post: 6280 days
Last view: 6280 days
Posted on 02-13-06 01:20 AM Link | Quote
Would it be legal to distribute a complete SMW disassembly, though?
Parasyte +

Red Paragoomba


 





Since: 01-05-06

Last post: 6600 days
Last view: 6600 days
Posted on 02-13-06 06:33 AM Link | Quote
Not entirely. The DMCA has some problems with distributing certain source codes within the US, and there are even worse laws against exporting certain source codes from the country. However, there is nothing (to my limited knowledge of the situation) against programs designed to generate such source codes.
Gavin

Cheep-cheep
Vandalism is not tolerated


 





Since: 11-17-05
From: IL, USA

Last post: 6356 days
Last view: 6299 days
Posted on 02-13-06 07:45 AM Link | Quote
Originally posted by LocalH
Perhaps one could combine a logging emulator backend with a comprehensive disassembler frontend? It's still going to be a lot of manual work, but this will at least aid in discerning code from data and making sure that the code is properly disassembled based on it's context. For example, if a particular opcode is ambiguous, one could merely enter a mode where the ROM is executed until said opcode is encountered, and then you have context. But definitely, one should aim to catch as much as possible with the disassembler, leaving the emulator to fill in the holes.


Originally posted by Parasyte +
It already handles stack manipulation with recursion. Jump tables containing additional data would be a special case. You would have to keep track of the path taken to reach the jump instruction in question so that it could be traced over more than once (in hopes of getting a different index) Same for indirect jumps which access RAM. Who knows how many pointers could be loaded into the location? Perhaps a label logger could be used to help find all of the tables used to set it.

Otherwise, there's not much left to do until it is "fully functioning".


Yes and yes. This is the exact solution that _Hyde_ used to create full NES rom disassemblies with his respective disassembler and NES emulator, SmartRENES and aNESe. Although his emulator lacks full mapper support and I'm not sure how far along both projects currently are, from what I remember it worked well. Run the emulator that produces the label files, then load the automatically generated label files into his disassembler. Like magic.
LocalH

Paragoomba


 





Since: 11-20-05

Last post: 6518 days
Last view: 6518 days
Posted on 02-14-06 10:12 PM Link | Quote
Originally posted by Parasyte +
Not entirely. The DMCA has some problems with distributing certain source codes within the US, and there are even worse laws against exporting certain source codes from the country. However, there is nothing (to my limited knowledge of the situation) against programs designed to generate such source codes.

Which is where the concept found here would come into play - it's a link to the instructions included with an Amiga Kickstart 1.2 disassembly. Basically, the comments were distributed, but not the actual disassembly, which was derived from a user-supplied ROM.
After the disassembly was done, it slowly came to me that I
couldn't legally give it to anyone, because after all, mixed in
with all my comments was a copy of Commdore-Amiga's proprietary
code. Yet, numerous people wanted a copy.

After much thought and experimentation, this method of making the
disassembly available to the general public was developed. The
comments are distributed, but the disassembly is not. Instead,
you get a "script" file, containing the comments and instructions
on how to recreate the disassembly, using code which is disassembled
right out of your ROM. Thus, I can distribute what I have written
and everybody can add what they already have, to get the whole
thing. It implies, of course, that without the right version of
the ROM (or kickstart disk), this whole file will be worthless to
you.
FreeDOS +

Giant Red Koopa
Legion: freedos = fritos








Since: 11-17-05
From: Seattle

Last post: 6279 days
Last view: 6279 days
Posted on 02-15-06 12:54 AM Link | Quote
So it's pretty much a cruder clean room disassembly.
MathOnNapkins

1100

In SPC700 HELL


 





Since: 11-18-05

Last post: 6279 days
Last view: 6279 days
Posted on 02-15-06 06:05 AM Link | Quote
So if these things are illegal, then why is stuff like Snowbro's disassembly of Metroid hosted to the public by metroid database? Should they be notified of a potential legal issue? I myself have a full disassembly of Zelda 3, but I'm not quite sure if I should distribute it freely.
FreeDOS +

Giant Red Koopa
Legion: freedos = fritos








Since: 11-17-05
From: Seattle

Last post: 6279 days
Last view: 6279 days
Posted on 02-15-06 02:01 PM Link | Quote
Not everyone knows that they are illegal. Essentially, by distributing a disassembly, you're also distributing the ROM, provided someone can re-assemble the code (which they probably can within 10 seconds of googling)
Ailure

Mr. Shine
I just want peace...








Since: 11-17-05
From: Sweden

Last post: 6279 days
Last view: 6279 days
Posted on 02-15-06 02:20 PM Link | Quote
I belive I have the SMB source code somewhere, dissassembled and commented. Never tried to compile it though.

And well, it will be legal to distribute disassembled copies of programs in the future, but you have to wait 70 years or so.
FreeDOS +

Giant Red Koopa
Legion: freedos = fritos








Since: 11-17-05
From: Seattle

Last post: 6279 days
Last view: 6279 days
Posted on 02-15-06 02:25 PM Link | Quote
But at the point of copyright expiration, it'd also be legal to freely distribute the compiled program too
MathOnNapkins

1100

In SPC700 HELL


 





Since: 11-18-05

Last post: 6279 days
Last view: 6279 days
Posted on 02-15-06 02:31 PM Link | Quote
Well here's the thing I'm unsure of. My disassembly is not reassembleable by any current tools, b/c it's more like a transcribed format. Furthermore, it's not the same as distributing a rom b/c it contains almost none of the data, only code.
FreeDOS +

Giant Red Koopa
Legion: freedos = fritos








Since: 11-17-05
From: Seattle

Last post: 6279 days
Last view: 6279 days
Posted on 02-15-06 02:34 PM Link | Quote
A case study of plagiarism

Sure photocopying the book of the plagiarising author won't reproduce the original book, but it doesn't change the legality.
MathOnNapkins

1100

In SPC700 HELL


 





Since: 11-18-05

Last post: 6279 days
Last view: 6279 days
Posted on 02-15-06 02:56 PM Link | Quote
So uh... did you have a change of heart, b/c last I heard you wanted to "plagiarize" Lunar Magic.

Either way, the case study is irrelevant to what we're discussing. Ripping someone off to make money on a book is one thing, distributing information on a piece of software without taking credit of authorship of that software seems a bit different. The intent is to communicate information to tinkerers, not the actual software. Without the data, the code is pretty much useless. By that logic, ram address listings as well as offset lists would also be illegal. What I've got is the software side, the other side is the data side.
FreeDOS +

Giant Red Koopa
Legion: freedos = fritos








Since: 11-17-05
From: Seattle

Last post: 6279 days
Last view: 6279 days
Posted on 02-15-06 03:33 PM Link | Quote
You were talking about reading the code and writing "new" code based directly off of the original. I was talking about one or more people reading the disassembly and clearly documenting it. Then other people read the documentation and implement completely new code.
LocalH

Paragoomba


 





Since: 11-20-05

Last post: 6518 days
Last view: 6518 days
Posted on 02-15-06 09:18 PM Link | Quote
Disassembly of a specific game engine is nothing close to plagiarism. You're trying to gain insight into how that specific game engine works, and for purposes of hacking that game engine you don't want to write a whole other engine based on the concepts found in the disassembled engine, you want to use the exact same engine that you've disassembled.
FreeDOS +

Giant Red Koopa
Legion: freedos = fritos








Since: 11-17-05
From: Seattle

Last post: 6279 days
Last view: 6279 days
Posted on 02-15-06 09:34 PM Link | Quote
Alright if possible, mind getting back onto topic...? there's probably no lawyers here and we're just going to go around in circles.
Pages: 1 2 3Add to favorites | Next newer thread | Next older thread
Acmlm's Board - I3 Archive - ROM Hacking - Ok, how about clean room disassembly of Lunar Magic? |


ABII

Acmlmboard 1.92.999, 9/17/2006
©2000-2006 Acmlm, Emuz, Blades, Xkeeper

Page rendered in 0.019 seconds; used 442.19 kB (max 564.27 kB)