1

I have used IDA to disassemble a big EPROM (27020) but there remain a large number of code sections which haven't been disassembled. Here is a typical one where I have identified the beginning and end (it was probably written in C):

            db  55h      push bp
            db  8Bh      mov bp, sp
            db 0ECh
            db 0A0h
            db  96h
            db  11h
            db 0FEh
            db 0C0h
            db 0A2h
            db  96h
            db  11h
            db  3Ch
            db    3
            db  75h
            db    5
            db 0C6h
            db    6
            db  96h
            db  11h
            db    0
            db  8Ah
            db  1Eh
            db  96h
            db  11h
            db 0B7h
            db    0
            db  8Ah
            db  87h
            db  2Fh
            db  13h
            db  5Dh     pop bp
            db 0C3h     retn

My question is, is there any easy disassembler I could feed this (or a pure hex version) into which will disassemble for me? Yes I can do it manually but there are hundreds like this so it would be really impractical and besides, this is only the first step in figuring out this code. I tried to search but after a few days figured it was time to ask those more knowledgeable than myself.

Improve this question
3
  • how did you load it into IDA and what CPU type did you use? IDA disassembles this byte sequence just fine (both in metapc and 80286 modes).
    – Igor Skochinsky ♦
    Commented Dec 26, 2019 at 19:16
  • First I loaded the hex file but that was a mess. I am more a hardware guy so I just followed the advice of someone who apparently wasn't too sure. In any case I converted to binary and tried that and got much better results. The problem is that this is a large (27020) EPROM so there is a very large amount of code, and of course there is a lot of data mixed in along with it. This means I have to go through IDA somewhat manually to identify what is code and what seems like data. This is a very long process with this large a file.
    – Peter Gottlieb
    Commented Dec 27, 2019 at 5:38
  • As I have some specific tasks I want to perform, my initial focus is on identifying where in the code the options are set. I have 2 different versions of code which (so far as I know) only differ by options selected at startup, however, the code has a lot of areas which disagree, so either routines are different or simply rearranged on linking. Too early to tell. I have the EPROM in the device and hooked to a logic analyzer so can see the startup and have already identified many of the setup routines from basic (loading interrupt vectors) to more complex (programming the associated FPGA).
    – Peter Gottlieb
    Commented Dec 27, 2019 at 5:44

2 Answers 2

Reset to default
1

You can open IDA, go to the beginning of the file, press shift, hold it, scroll to the end of the file - which will result that the whole code is selected, and press 'c' for analysis.

Improve this answer
0

Since you mentioned hex files, one additional issue you could have hit is difference between 16-bit and 32-bit code. Hex file loader probably defaults to 32-bit while this code seems to be 16-bit. Editing segment properties to mark it as 16-bit after loading should give you better results.

Improve this answer
1
  • Thank you Igor. Yes, the code is almost certainly 16 bit.
    – Peter Gottlieb
    Commented Dec 27, 2019 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.