SAD 806x Disassembler

[Pym]

New version is released.
Still on 1.2 but with today date (I call it 1.2e).
Still some kind of pre-release for 1.3 version.
- Structures analysis algorithm has evolved (second version).
- Signatures are now labelled Routines Signatures.
- Elements Signatures part is added (and pre-filled with MAF Transfer signature).
- Binaries comparison is now available after disassembly (to provide already identified elements list, when they are in difference).
Many other changes are included :
- Signatures can now generate BitFlags.
- Short Labels and Labels conflicts are now managed.
- Other corrections done for more stability, recognition.

Sources will follow, if you find this version stable enough.

[jsa]

Thank you Pym.

[decipha]

excellent, ill give it a whirl soon as time permits?

[decipha]

i cant get it to work, wont let me define the range for banks

see attached

[Pym]

SAD 806x does not permit to define range for banks, it autodetects it and it does the job on cdan4, that is what I can see, no ?

[decipha]

no its erroring out, see the attached zip with bin

[Pym]

1 error on disassembly and 3 on output, I think it is errors we had already talked about.
Result seems acceptable for me. I will have a deeper look on these errors to be sure.

[Pym]

Hi all,

just to say I am currently developing the new version of the disassembler. In fact no, I am testing it.
The purpose for the 1.3 version is to make S6x creation much easier (and for sure to correct the maximum number of bugs).
When working on some disassembly, I have seen that some updates could speed up the work.
So interface is easier to use and many tools have been added for binary/strategy comparison, including 2d map and setup copy.

I will tell you more on that quickly.

[jsa]

Sounds like some great feature additions.

[Pym]

Some examples for new features in version 1.3 :
- Menu on items have been extended (with New or Paste options). Really useful when working on the end of a list with thousand items.
- New option in Menu items : Paste and overwrite. Where paste just paste a new item with a defaulted address, Paste and overwrite paste on current address.
It permits to copy from another item or another strategy, without losing address. For example by creating quickly a new defaulted item with just the right address.
You paste on it and nothing else has to be done.
- When filling items details, a new keyboard shortcut permits to give uppercase or lowercase on the selected text (Ctrl-Shift-U for upper or Ctrl-U for lower).
- Registers can now be created with '+' character. For example [Ra3+12] has to use address a3+12.
- Registers have now their specific Byte label and Word label if required.
- Little trick when importing from TunerPro, when TunerPro Label start with (for example) FN0036 - MAF Transfer,
first part before '-' goes to Short Label (FN0036) and second part (after '-') goes to Label (MAF Transfer).
- 'Search Signature' is a new added tools to test a signature or search for it.
- 'Comparisons' is a new sub menu in tools available after disassembly. It will give more details.

The main feature is the Comparisons tool set.
When disassembling more than one strategy in the same time, logically they are really near.
In this case creating signatures takes too much time and is not probably the first thing to do.
- When binaries are on the same strategy, the main thing to know is 'What are the differences' and for that you will find option 'Binaries Comparison (Same definition)'.
It will provide you all identified elements that have changed values between both binaries.
- When strategies are different and you have habit to work with 2d charts to compare data, 'Calibration Chart View' is a good starting point.
To get better results, the best thing is to have a compared binary with a detailled s6x (you know, in the same folder, with the same name).
Labels will be dispatched on chart and when clicking you will see what is the related item.

Still when strategies are different the best tool set is 'Routines Comparison'.
To get better results, the best thing is to have a compared binary with a detailled s6x (you know, in the same folder, with the same name).
- 'Export Skeleton' option, permits to generate a routines skeleton from current strategy, to be compared later.
- 'Compare Skeleton' option, permits to compare a routines skeleton file to the current strategy.
The purpose of this option is to identify similar routines between 2 strategies, based on probabilities. A report is generated for text analysis.
- 'Compare Binaries' option, is an all in one functionality, because it generates and compare directly strategies routines skeletons.
It works exactly like previous functionality, but in addition to similar routines identification, it does the job on included items too.
Included items could be registers, tables, functions, structures or scalars and just by using context menu on item,
you can get the other setup directly (just check probability or occurrences info before).
You can do it for routines too or for a set of items.

Similar items identification works really well and can be applied directly, but I still have a issue for Registers and Bit Flags.
For Registers, direct info copy is a bit risky when strategy has different meanings for Byte and Word versions of the register.
For Registers used as Bit Flags, direct info copy is a bit risky too, because Bit Flags are often some kind of pool of registers.
for example, in strategy A has BF Ra1 0=>7, Ra2 0=>7
strategy B will have Re4.B0 = Ra1.B0, but does not contain Ra1.B4 so Re4.B4 = Ra1.B5, ... Re5.B7 = Ra2.B6 and to end Re6.B1 = Ra2.B7
Can you really say that Re4 = Ra1, Re5 = Ra2 ? because Re6.B1 = Ra2.B7.

To finish, this is how I work now :
- I have to work on a 2000 strategy (strategy A).
- I take a good definition around 2000 too (strategy B) to create a S6x file if not existing (from TunerPro format + SAD DIR files (for registers) + SAD CMT files)
- I open SAD806x on strategy A and compare it with 'Compare Binaries' option with Strategy B. If strategies are really near, result is excellent.
- I export generated report.
- I get all similar items.
- I analyse on a text editor the report to look at all identical routines and get all remaining items.

[motorhead1991]

Some examples for new features in version 1.3 :
- Menu on items have been extended (with New or Paste options). Really useful when working on the end of a list with thousand items.
- New option in Menu items : Paste and overwrite. Where paste just paste a new item with a defaulted address, Paste and overwrite paste on current address.
It permits to copy from another item or another strategy, without losing address. For example by creating quickly a new defaulted item with just the right address.
You paste on it and nothing else has to be done.
- When filling items details, a new keyboard shortcut permits to give uppercase or lowercase on the selected text (Ctrl-Shift-U for upper or Ctrl-U for lower).
- Registers can now be created with '+' character. For example [Ra3+12] has to use address a3+12.
- Registers have now their specific Byte label and Word label if required.
- Little trick when importing from TunerPro, when TunerPro Label start with (for example) FN0036 - MAF Transfer,
first part before '-' goes to Short Label (FN0036) and second part (after '-') goes to Label (MAF Transfer).
- 'Search Signature' is a new added tools to test a signature or search for it.
- 'Comparisons' is a new sub menu in tools available after disassembly. It will give more details.

The main feature is the Comparisons tool set.
When disassembling more than one strategy in the same time, logically they are really near.
In this case creating signatures takes too much time and is not probably the first thing to do.
- When binaries are on the same strategy, the main thing to know is 'What are the differences' and for that you will find option 'Binaries Comparison (Same definition)'.
It will provide you all identified elements that have changed values between both binaries.
- When strategies are different and you have habit to work with 2d charts to compare data, 'Calibration Chart View' is a good starting point.
To get better results, the best thing is to have a compared binary with a detailled s6x (you know, in the same folder, with the same name).
Labels will be dispatched on chart and when clicking you will see what is the related item.

Still when strategies are different the best tool set is 'Routines Comparison'.
To get better results, the best thing is to have a compared binary with a detailled s6x (you know, in the same folder, with the same name).
- 'Export Skeleton' option, permits to generate a routines skeleton from current strategy, to be compared later.
- 'Compare Skeleton' option, permits to compare a routines skeleton file to the current strategy.
The purpose of this option is to identify similar routines between 2 strategies, based on probabilities. A report is generated for text analysis.
- 'Compare Binaries' option, is an all in one functionality, because it generates and compare directly strategies routines skeletons.
It works exactly like previous functionality, but in addition to similar routines identification, it does the job on included items too.
Included items could be registers, tables, functions, structures or scalars and just by using context menu on item,
you can get the other setup directly (just check probability or occurrences info before).
You can do it for routines too or for a set of items.

Similar items identification works really well and can be applied directly, but I still have a issue for Registers and Bit Flags.
For Registers, direct info copy is a bit risky when strategy has different meanings for Byte and Word versions of the register.
For Registers used as Bit Flags, direct info copy is a bit risky too, because Bit Flags are often some kind of pool of registers.
for example, in strategy A has BF Ra1 0=>7, Ra2 0=>7
strategy B will have Re4.B0 = Ra1.B0, but does not contain Ra1.B4 so Re4.B4 = Ra1.B5, ... Re5.B7 = Ra2.B6 and to end Re6.B1 = Ra2.B7
Can you really say that Re4 = Ra1, Re5 = Ra2 ? because Re6.B1 = Ra2.B7.

To finish, this is how I work now :
- I have to work on a 2000 strategy (strategy A).
- I take a good definition around 2000 too (strategy B) to create a S6x file if not existing (from TunerPro format + SAD DIR files (for registers) + SAD CMT files)
- I open SAD806x on strategy A and compare it with 'Compare Binaries' option with Strategy B. If strategies are really near, result is excellent.
- I export generated report.
- I get all similar items.
- I analyse on a text editor the report to look at all identical routines and get all remaining items.

Are you going to join us in the OpenEEEC chat yet? I keep trying to get TVR in there as well.

[Pym]

It could be, but for now better than words ...

Do not forget the new included dll.

[decipha]

excellent she seems to be running nicely, i ran cdan4 through it and rzasa with no problems

i didnt check but does the exported xdf put the memory addressing in order?

I take it patches aren't copied over from imported xdf's to exported xdf's correct?

[rocks08]

OMG

This version is awesome. you have make lot of works for the comparison

i will play a long time with it

[Pym]

i didnt check but does the exported xdf put the memory addressing in order?
I take it patches aren't copied over from imported xdf's to exported xdf's correct?

Nothing has really changed for this part.
When creating a new Xdf, XdfUniqueId for item is created ordered by address.
When updating an existing Xdf, XdfUniqueId are kept, so nothing is reordered and patches stays in place too.

[wwhite]

Using SAD806x 1.3 20190603, on Linux with wine, trying to change the command options, does not appear to work.

I want to go completely manual, using only directive file.
I put the following at the top of the directive file:
----- Commands ------
opts : C M
bank 00000 0dfff 8
... ...

In the output listing file, always has
Options :
Default options

Is the command options not working correctly in this version, or is it an oddity with wine?

Also, cannot get the comments file to work correctly(import .cmt)

[decipha]

i coulsnt get it to work wither using a 256k 2 bank file it wouldnt let me

[Pym]

Using SAD806x 1.3 20190603, on Linux with wine, trying to change the command options, does not appear to work.
I want to go completely manual, using only directive file.
I put the following at the top of the directive file:
----- Commands ------
opts : C M
bank 00000 0dfff 8
... ...

In the output listing file, always has
Options :
Default options

Is the command options not working correctly in this version, or is it an oddity with wine?

Also, cannot get the comments file to work correctly(import .cmt)

No way to use a fully manual disassembly mode with SAD806x.
SAD directive opts : C M or bank 00000 0dfff 8 are always ignored.
SAD .dir file import permits to import elements, routines or operations, but nothing else.
SAD .dir file export tries to generate a fully usable .dir file, by recreating a defaulted structure,
but it has to be reviewed manually to match what is really expected.

SAD .cmt files have to be imported after .dir import of after SAD806x first disassembly.
They should match with an already known address, otherwise they will fall into "'Other Addresses".
SAD .cmt files could also generate format issues, I have not seen so much and mines work fine, have you an example ?

[Pym]

i coulsnt get it to work wither using a 256k 2 bank file it wouldnt let me

Could you please send me this file ?

[wwhite]

SAD .cmt files could also generate format issues, I have not seen so much and mines work fine, have you an example ?

I am trying to add simple comments, here is an example:

Code: Select all

.txt file has:
Bnk8Start:
8 2000: ff        ff
8 2001: fa       di        disable ints;
...
.dir file has:
sym 2000 8 "Bnk8Start"
sym 2032 8 "Sub00002"
...
.cmt file has:
2001 # My Comment, disable interrupts.

I am not sure if my .cmt formatting is correct, or if order of import->disassemble->output is correct?

[decipha]

i thought it had to be tank before address no spaces

sym 82032 "subr_blahblah"

[Pym]

i thought it had to be tank before address no spaces
sym 82032 "subr_blahblah"

For .dir file, format is ok like described in SAD documentation.
sym 2000 8 "Bnk8Start"
sym 2032 8 "Sub00002"

Same thing for .cmt file,
but comments are never managed coming from .cmt file for operations, so this comment is probably created in Other part.

Order is fine, the main one to respect is .dir, then .cmt.

[decipha]

i coulsnt get it to work wither using a 256k 2 bank file it wouldnt let me

Could you please send me this file ?

attached

[Pym]

i coulsnt get it to work wither using a 256k 2 bank file it wouldnt let me

Could you please send me this file ?

attached

I see not particular issue with last delivered SAD806x version 1.3.
One error is detected on disassembly, but without any consequence.
Have you more details on you issue ?
I attach a print screen (some differences visible on the version, 1.3a, I will deliver it soon, but same result on 1.3).

[Pym]

A new version of the tool is linked.
I call it 1.3a with a release date set for today (for history purpose).
I always use this one, but I have not tested all updates.

It is an interesting version for many reasons:

- Duplicated elements (Tables, Functions, Scalars and structures) are managed inside tool and with TunerPro Import/Export.
Same address, but different scaling, versioning for history, ...
Only the main element is processed in disassembly output, so new options in menu are added to create / switch from main.

- Update on Import/Export Copy/Paste with TunerPro.
First thing, Copy Xdf and then paste into TunerPro works now. There was an issue with encoding, TunerPro accepts only ANSI for paste input (no UTF-8 or Unicode).
So special characters can cause bad result.

Second Thing, Export Xdf was managed as UTF-8 export too, be understood as ANSI by TunerPro, with issues on special characters.
In this case it works with Unicode, so Export is now done through unicode.

Michael, you talk me about ordering in Xdf files, it was working the first time only when you were exporting.
I have now added a button to reset XdfUniqueId in S6x file. It permit to create a new Xdf file well sorted, even after a first export.

Short Label / Label management has been reviewed between both software.
Import in SAD806x will look at TunerPro Label, then at TunerPro description to search something like xxxx - yyyyyy.
xxxx will become the short label and yyyyyy the label.
For Export short label is forced at the beginning of the comment, if not at this place, to be set in TunerPro description. xxxx - comment.
So my advice is to use Short Label only at the beginning of the comment in TunerPro and in SAD806x.

Last thing is on BitFlags import, which is not managed anymore as a bitflag, when only B0 is set.
It is far more easy to use (for label and short labels) when scalars are switches.

- Scalers on tables have been review too.
First to manage duplicated functions (which is really interesting).
Secondly to be able to display details in a tooltip, when mouse is on the related button,
really useful when working on EECV with many, many scalers.
Finally to be able to search them.

- Data Scaling on tables, directly visible in SAD806x.
Just for fun, but finally useful to quickly identify some scalers or tables.

- Repository management - "Ctrl R".
You have identified a table, a function, a structure, a scalar or a register, but you do not want to write its short label, label or comment.
If you have the perfect repository, just use Ctrl R keys, when you are in a text field and you will be able to search your identified item in the related repository.
Then by selecting it it will fill in for you short label, label or comment.
If you do it on Units fields, you will search for Units from repository and fill in this field.
If you do it on Scale fields, you will search for a scaling from repository and fill in this field.
If you right click on shown data, you will be able to test additional scaling from repository.

But you will have to create your own repository, in fact Xml files in the SAD806x folder.
You can create, update them and mass load them from S6x, from ? menu.
I just provide a basic conversion.xml file to begin.
If you are having issues when saving them, just put SAD806x folder in another place or start it as administrator.
You can after that create dedicated files, because for example EEC IV is not as complete as EEC, but SAD806x will only load one version.
If you want to share them or to translate them, it will be appreciated.

- Mustang 86 VP1 (and sisters) is now well managed too.
A issue was existing with RBase detection on it, but I had not searched for pre GUFX strategies before, so...
By the way, if you know a well disassembled strategy (good names an descriptions), pre GUFX,
100% based on Open loop, it will be interested for my work on European strategies,
which have switched from a pre GUFX strategy (100% Open loop, but not VP1 or LUX0)
to the same core than CBAZA, but in 1992 / 1993, when Closed loop was required.

[motorhead1991]

How would I go about reassigning a function/structure that 806x established? I'm working on an EEC-V binary but the MAF curve is not identified as a function.

Also, being able to load an XDF template for category organizing would be awesome.

[Pym]

How would I go about reassigning a function/structure that 806x established? I'm working on an EEC-V binary but the MAF curve is not identified as a function.
Also, being able to load an XDF template for category organizing would be awesome.

For reassigning MAF Transfer that was detected as structure, juste create a new function at the same address (Word/Word with 1 row at least, 30 rows for MAF Transfer).
It will ask you to overwrite the structure. You can also remove the structure and create a basic function at the same address (word/word 1 row at least) and disassemble another time.

For TunerPro categories, it could be an idea, but I am never working with them.
By the way I could surely do something .

[jsa]

Thanks for the update Pym.

[Pym]

Just detected an issue when using last update on Windows 10 (Windows 10.0.17763 (1809)).
Software can freeze when trying to output an item (when previous item was having comments with carrier returns and with the same thing on new item).
I use a temporary version to continue working, waiting Microsoft to correct the issue. Just tell me if you need it.

[Pym]

A new version of the tool is linked.
I still call it 1.3a with a release date set for today (for history purpose).
This is the most stable version, which I am using each time.
No new functionality (I think), but many small corrections, for accuracy, speed and so on.

The main thing, is its documentation, which is not in the archive, for size reason.
If you put the pdf file, in the SAD806x folder, you can open it from the tool.

Sources will follow quickly.

[decipha]

very nice i will tinker with it

[jsa]

Good stuff, thanks Pym.

[wwhite]

Love the PDF document!

[Pym]

Love the PDF document!

Yes it was more than necessary, I was adding more and more things in the tool and no one was knowing exactly what it was, even me sometimes.

And now, please find attached the related sources, still based on visual studio 2008.

[motorhead1991]

Love the PDF document!

Yes it was more than necessary, I was adding more and more things in the tool and no one was knowing exactly what it was, even me sometimes.

And now, please find attached the related sources, still based on visual studio 2008.

Mind if I create a GitHub repository for it?

[jsa]

Yes it was more than necessary, I was adding more and more things in the tool and no one was knowing exactly what it was, even me sometimes.
.

Thanks, the PDF is a big help.

[Pym]

Mind if I create a GitHub repository for it?

No issue on my side, you can do it, it could be very interesting.

[motorhead1991]

Mind if I create a GitHub repository for it?

No issue on my side, you can do it, it could be very interesting.

Alright, you're up and going. I don't have a valid email address for you so I left that bit out. Next, one of us needs to write up a "Readme" file that explains the project and potentially how to build it.

OpenEEC SAD806x