Tiny disassembler and IDA processor modules for microcontroller

[stfsux]

Hi,

I'm currently working on a tiny disassembler and IDA processor modules for microcontroller.
I'm a bit lazy so I'll paste the README here.

udasm
Tiny disassembler  for microcontrollers  with configurable  memory map.  Most of
existing disassemblers for microcontrollers are either a part of binutils or IDA
processor modules  with a static  memory map. In  other words, you  usually have
either  to recompile  the  processor module  or use  a  third-party script  that
handles internal registers. Thanks to libconfig,  with udasm you can easly write
your own memory map with a single configuration file and without recompiling the
whole s**t.

Supported architectures
- Intel 8051
- ATMEL AVR 8(16)-bit

Supported file format
- Binary

Memory map configuration
Memory map configuration contains 2 main parts.
One that defines all specific code location such as interruptions.
And the other one that defines all internal registers mapped in memory.

To specify an interruption in the memory map configuration file you have
to define a global variable named CODE where you can list all interruptions
in a variable named 'interrupts'.
Each interruption has the following format: ( "name", offset, size, "type" ).
- name: quoted string holding the name of the interrupt.
- offset: location of the interrupt in the firmware.
- size: size in byte of the interrupt.
- type: quoted string defining the type of the interrupt.
 - data: the location is an address of the routine (e.g. isr vector table in arm cortex-m). Currently not fully supported.
 - code: the location is a routine (e.g. most of avr/i8051/etc. usually containing an absolute jump to the routine).

Internal registers mapped in memory can be defined in a global variable name 'IDATA' and listed
in variable named 'map'. Each element of this list may contain the following variables:
- page: memory page which contains the internal registers.
- busid: an architecture specific id for some instructions that use an other memory map layout.
E.g. in some AVR, memory operand of in/out instruction might have an implicit offset from the physical memory layout. lds r0, 0x0020 is the same shit as in r0, 0x00.
- registers: an array of 2 elements, a quoted string of the register's name and a location.
- bits: an array of 2 elements, a quoted string of the bit's name and a location.

See xmega128a1.cfg as an example.

Architecture specific
- AVR
  - busid: 0x01 for in/out memory operand.

IDA procmod
- Intel 8051
- ATMEL Avr 8(16)-bit

TODO
- done Add listview with all internal registers.
- done Add xref for each internal register.
- done IDA procmod for avr.
- PIC architecture.
- Ability to define global variables in the memory map configuration file.
- IDA procmod
  - select a different page for a specific memory operand in disassembly.

Using IDA procmod
- Load a new memory map configuration file
  - File -> Load file -> Load new memory map...
- Show all internal registers
  - View -> Open subviews -> Internal registers
- Show all internal bit registers
  - View -> Open subviews -> Internal bit registers
- Show all interruptions
  - View -> Open subviews -> List of interruptions
- Show all xref(s) to an internal register
  - Double click on that item in the list of internal registers

IDA procmod screenshot


Any comment(s) or suggestion(s) would be appreciate.

[stfsux]

Hi,

A little update.

README

Code: [Select]

udasm
=====

Tiny disassembler  for microcontrollers  with configurable  memory map.  Most of
existing disassemblers for microcontrollers are either a part of binutils or IDA
processor modules  with a static  memory map. In  other words, you  usually have
either  to recompile  the  processor module  or use  a  third-party script  that
handles internal registers. Thanks to libconfig,  with udasm you can easly write
your own memory map with a single configuration file and without recompiling the
whole shit.

The standalone disassembler in command line uses ANSI escape codes in order to
print colorized assembly. On windows it's not supported but there are still some
emulators which support ANSI escape codes (such as ConEmu, PowerShell, etc.).


libudasm
--------

There is currently no documentation.


Supported architectures
-----------------------

- Intel 8051
- ATMEL AVR 8(16)-bit
- Microchip PIC high-end core devices


Supported file format
---------------------

- Binary


Memory map configuration
------------------------

Memory map  configuration contains 2 main  parts. One that defines  all specific
code location such as interruptions. And the other one that defines all internal
registers mapped in memory.

To specify  an interruption  in the  memory map configuration  file you  have to
define a global  variable named CODE where  you can list all  interruptions in a
variable named 'interrupts'.

Each interruption has the following format: ( "name", offset, size, "type" ).
- name: quoted string holding the name of the interrupt.
- offset: location of the interrupt in the firmware.
- size: size in byte of the interrupt.
- type: quoted string defining the type of the interrupt.
 - data: the location is an address of the routine (e.g. isr vector table in ARM
         cortex-m).
 - code: the location is a routine (e.g. most of avr/i8051/etc. usually
         containing an absolute jump to the routine).

Internal registers mapped in memory can be defined in a global variable name
'IDATA' and listed in variable named 'map'. Each element of this list may
contain the following variables:
- bank: memory bank which contains the internal registers.
- busid: an architecture specific id for some instructions that use an other
         memory map layout. E.g. in some AVR, memory operand of in/out
         instruction might have an implicit offset from the physical memory
         layout. lds r0, 0x0020 is the same shit as in r0, 0x00.
         All registers with a busid not equal to zero are not listed
         in IDA procmod since they are just mapped differently.
- registers: an array of 2 elements, a quoted string of the register's name and
             a location.
- bits: an array of 2 elements, a quoted string of the bit's name and a
        location.

See xmega128a1.cfg as an example.

You can also define all global variables in a separate configuration file.
This one should only have a list of all variables listed in 'global_variables'
with the following format: ( "name", address ).
- name: quoted string holding the name of the variable.
- address: the location in RAM of this variable.

See variables-test.cfg as an example.

Architecture specific
---------------------

- AVR
  - busid: 0x01 for in/out memory operand.
- PIC18
  - busid
    . 0x00: Unbanked memory region (e.g. movff 0x1234,0x5678).
    . 0x01: banked memory region (e.g. movfw 0x12, W, 1)


Compile
-------

Windows

Before running nmake you must setup directories in dir.nmake.
Then type:
nmake /f makefile.nmake

By default it assumes you're compiling in x32.
You can force to compile in x64 by typing:
nmake /f makefile.nmake UDASM_ARCH=x64

GNU/Linux
Type:
make -f makefile.gmake

*BSD
Fuck off.

Mac
AhAHHAhGhgaHgahAGhAgagahaghGAHGGHAhAGHAGhAGHh

Amiga
Type:
AMIGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA!

TODO
----

- 68HC08 (m6805) and derrivate architectures.
- Support global variable configuration file for the command
  line interface.


IDA procmod PORN
----------------

IDA Screenshit: preview.png

- Load a new memory map configuration file
  - File -> Load file -> Load new memory map...
- Show all internal registers
  - View -> Open subviews -> Internal registers
- Show all internal bit registers
  - View -> Open subviews -> Internal bit registers
- Show all interruptions
  - View -> Open subviews -> List of interruptions
- Show all global variables
  - View -> Open subviews -> Global variables
- Show all xref(s) to an internal register/variable
  - Double click on that item in the listview
- Unload variable/memory map configuration
  - File -> Load file -> Load new memory map...
    Then click Cancel or no (depends what you want to unload).


Release
-------

. cfg/test.cfg: a random memory map file for test.
. cfg/xmega128a1.cfg: a complete memory map file for avr xmega128a1.
. cfg/pic18f4550.cfg: a complete memory map file for PIC18F4550.
. mcu8051.w32: i8051 procmod for IDA 6.6
. mcuavr8.w32: avr 8(16)-bit procmod for IDA 6.6
. mcupich.w32: pic high-end core devices procmod for IDA 6.6
. udasm.exe: standalone disassembler in command line

CHANGELOG

Code: [Select]


CHANGELOG
=========


- ??/??/????
  . [ida] Add listview with all internal registers.
  . [ida] Add xref for each internal register.
  . [ida] IDA procmod for avr.
  . [ida] PIC high-end core devices architecture.
  . [ida] Ability to define global variables in a separate memory map
          configuration file.
  . [ida] Show read/write mode in the xref list of internal registers.
  . [ida] Clean all global name before reloading a new memory map.
  . [ida] Close all opened choose2 dialog box before reloading a new memory
          map.
  . [lib] avr8: brlt instruction was missing.
  . [lib] mmap: null pointer check before access
  . [ida] Rename all symbols that are not specific to the corresponding
          architecture (e.g. mcuavr8_xref_something to xref_something).
  . [lib] Replace the keyword "page" by "bank" just because.


- 18/05/2017
  . [lib] Rename the whole shit "libmcu" to "libudasm".
  . [all] x64 support (without ida proc mods of course).
          Nmake makefile provided to compile libconfig
          for x64/32. Check tools/libconfig-1.5 folder.
          Run nmake /f makefile.nmake UDASM_ARCH=x64.
  . [all] version 0.0.002 to 0.0.003



[abyrvalg]

What is the difference from i51.cfg and avr.cfg files of IDA?

[r0d3z1]

Interesting, is it still an active project ?