Setting register names in Radare2

Question

I am reverse-engineering an 8051 architecture program of a specific chip. The disassembly naturally doesn't contain any function names, and the register names are minimal. For example, address 0xb3 is a specific register with the name "RTC2CON". since the register name is specific for the chip the disassembly doesn't show it but rather "0xb3".

My question is how can I set a rule that will replace every occurrence of a certain string in the disassembly (in this case 0xb3) with another string (the register name RTC2CON).

Another Example

|           0x0000393b      c2e9           clr 0xe8.1                  ; 
|           0x0000393d      1239dd         lcall TRANSMIT_r7_AND_GET_r7=RF_STATUS
|           0x00003940      e4             clr a
|           0x00003941      ff             mov r7, a
|           0x00003942      1239dd         lcall TRANSMIT_r7_AND_GET_r7=RF_STATUS
|           0x00003945      8f36           mov 0x36, r7                ; 
|           0x00003947      d2e9           setb 0xe8.1                 ; 
\           0x00003949      22             ret

To be more clear the chip is the nRF24LE1. In this example there is a manipulation on the special function register on adress 0xe8 (RFCON) Bit 1 is firstly cleared, and after some operation it is set again.

What I want is simply that the dissasembly will display RFCON.1 instead of 0xe8.1

Another problem I have is with a function that is called using ljmp instead of lcall. When I try to rename that function with afn the new name goes instead to the function calling it with ljmp. The function called has 58 XREFS and therefore it is very important to me to see it's name and not it's address when it is called. (functions default name is their fcn.address).

Answer 1

not sure what b3 register is

as to naming the destination of calls / jumps you do something like this

[0x00000788]> pd~lcall
|           0x00000797      124ef3         lcall 0x4ef3
|       |   0x000007a7      124ac0         lcall 0x4ac0
[0x00000788]> f loc.somefun @0x4ef3
[0x00000788]> f loc.somefun2 @0x4ac0
[0x00000788]> pd~ljmp
        ,=< 0x000007cd      024ac4         ljmp 0x4ac4
[0x00000788]> f loc.somejump @0x4ac4
[0x00000788]> pd~ljmp
        ,=< 0x000007cd      024ac4         ljmp loc.somejump
[0x00000788]> pd~lcall
|           0x00000797      124ef3         lcall loc.somefun
|       |   0x000007a7      124ac0         lcall loc.somefun2
[0x00000788]>

is it about special function register from 0x80 to 0xff

you can probably flag them as shown above

[0x000000b3]> s 0xb3
[0x000000b3]> pd 2
            ;-- reg.RTC2CON:
            0x000000b3      00             nop
            0x000000b4      00             nop
[0x000000b3]> f reg.RTC2CONNED @ 0xb3
[0x000000b3]> pd 2
            ;-- reg.RTC2CON:
            ;-- reg.RTC2CONNED:
            0x000000b3      00             nop
            0x000000b4      00             nop
[0x000000b3]>

i remembered it flagged the sfr's automatically but it seems its implementation is not complete you may have to either add the required bits and submit a pull request or open an issue in

it decodes 8 bits out of possible 16 bits src is here 8051 implementation

i just made simple test result as follows

>xxd sfrtest.bin
0000000: c2e0 c2e1 c2e2 c2e3 c2e4 c2e5 c2e6 c2e7  ................
0000010: c2e8 c2e9 c2ea c2eb c2ec c2ed c2ee c2ef  ................
>radare2 -a 8051 sfrtest.bin
 -- This software is sold for home use only and all other rights are expressly reversed by the copyleft owner.
[0x00000000]> pd 10
            0x00000000      c2e0           clr acc.0                   ; [0x100001e0:1]=0
            0x00000002      c2e1           clr acc.1                   ; [0x100001e0:1]=0
            0x00000004      c2e2           clr acc.2                   ; [0x100001e0:1]=0
            0x00000006      c2e3           clr acc.3                   ; [0x100001e0:1]=0
            0x00000008      c2e4           clr acc.4                   ; [0x100001e0:1]=0
            0x0000000a      c2e5           clr acc.5                   ; [0x100001e0:1]=0
            0x0000000c      c2e6           clr acc.6                   ; [0x100001e0:1]=0
            0x0000000e      c2e7           clr acc.7                   ; [0x100001e0:1]=0
            0x00000010      c2e8           clr 0xe8.0                  ; [0x100001e8:1]=0
            0x00000012      c2e9           clr 0xe8.1                  ; [0x100001e8:1]=0
[0x00000000]>