6

UPDATE 3: I learned that one way to do it is to simply make a new processor definition, it should be fairly straight forward to port already existing 68k disassemblers to the IDA SDK. Still too cumbersome in my case because I only have a single 68k project that needs analyzing. This solution will work with older IDA releases in case the free updates period has expired and one is too poor to refresh one's IDA license.

UPDATE 2: Igor Skochinsky points out that there's a bugfix. I still want to know what is the best work-around for older IDA (6.1).

UPDATE: I found that later version of IDA such as 6.8 (which I don't have access to) has a "mapaddr" command in the machine .cfg files. Don't know what mapaddr does exactly, can it multi-map addresses?

Original post:

In this question: https://stackoverflow.com/questions/30987128/m68k-ida-pro-24-bit-addressing/38314561 the user had a similar problem to mine, that was never solved.

Lots of 68000 systems have 64kb of RAM mapped in two 32kb segments, FF8000-FFFFFF and 0-7FFF, so you can use word addressing to reach the entire RAM faster, because branch offsets are 15 bits+sign. This was common on other processors as well back in the day.

I split the code dump into two segments like that, however doesn't really work, because the Motorola 68k is a bit schizophrenic when it comes to addressing. Is it 16, 24 or 32 bit? It is really all at once.

IDA doesn't take this into account, meaning it won't understand instructions like this:

movea.w #$8234, a0
move.l (a0.w), d0

This should move the dword at FFFF8234 to d0. I'd like IDA to understand that $8234 is the same as $ffff8234 and use the symbols etc.

What I have done is to find every movea and lea instruction and if they are loading wrapped around addresses, I change them to a manual operand referencing the FFxxxx space.

However, while that let's me inspect the references (by clicking them) IDA doesn't really understand how the addressing works, meaning I get little other help from the environment, and subroutines and calls are not detected correctly.

For the record I am not an advanced IDA user.

Edit: for you non-68k guys, movea and lea are just move instructions that can put stuff in address registers, (almost) all addressing is with address registers a0-a7.

  • 1
    hex-rays.com/products/ida/6.9 BUGFIX: mc68k: address bus width for mc68000, mc68010, cpu32 reduced to 24 bits – Igor Skochinsky Jul 13 '16 at 10:05
  • @IgorSkochinsky Thanks! You should make it an answer, I will accept it unless somebody else comes along with some clever work-around. – user6576405 Jul 13 '16 at 11:59
  • @IgorSkochinsky By the way, I was not able to find documentation online about "mapaddr". What does it do? I saw it was used in the Tricore definition. – user6576405 Jul 13 '16 at 12:01
  • @IgorSkochinsky problem was solved not correctly. In 6.95 IDA some jumps becomes not recognized (contact me with PM, and I send you example). And mapaddr is just internally used in Tricore. – Dr. MefistO Mar 19 '17 at 14:08
  • @Dr.MefistO please send a report to support, thanks. – Igor Skochinsky Mar 19 '17 at 19:02
1

support for 24-bit address space for 68k has been added in IDA 6.9: https://www.hex-rays.com/products/ida/6.9/

BUGFIX: mc68k: address bus width for mc68000, mc68010, cpu32 reduced to 24 bits

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.