6

UPDATE 3: I learned that one way to do it is to simply make a new processor definition, it should be fairly straight forward to port already existing 68k disassemblers to the IDA SDK. Still too cumbersome in my case because I only have a single 68k project that needs analyzing. This solution will work with older IDA releases in case the free updates period has expired and one is too poor to refresh one's IDA license.

UPDATE 2: Igor Skochinsky points out that there's a bugfix. I still want to know what is the best work-around for older IDA (6.1).

UPDATE: I found that later version of IDA such as 6.8 (which I don't have access to) has a "mapaddr" command in the machine .cfg files. Don't know what mapaddr does exactly, can it multi-map addresses?

Original post:

In this question: https://stackoverflow.com/questions/30987128/m68k-ida-pro-24-bit-addressing/38314561 the user had a similar problem to mine, that was never solved.

Lots of 68000 systems have 64kb of RAM mapped in two 32kb segments, FF8000-FFFFFF and 0-7FFF, so you can use word addressing to reach the entire RAM faster, because branch offsets are 15 bits+sign. This was common on other processors as well back in the day.

I split the code dump into two segments like that, however doesn't really work, because the Motorola 68k is a bit schizophrenic when it comes to addressing. Is it 16, 24 or 32 bit? It is really all at once.

IDA doesn't take this into account, meaning it won't understand instructions like this:

movea.w #$8234, a0
move.l (a0.w), d0

This should move the dword at FFFF8234 to d0. I'd like IDA to understand that $8234 is the same as $ffff8234 and use the symbols etc.

What I have done is to find every movea and lea instruction and if they are loading wrapped around addresses, I change them to a manual operand referencing the FFxxxx space.

However, while that let's me inspect the references (by clicking them) IDA doesn't really understand how the addressing works, meaning I get little other help from the environment, and subroutines and calls are not detected correctly.

For the record I am not an advanced IDA user.

Edit: for you non-68k guys, movea and lea are just move instructions that can put stuff in address registers, (almost) all addressing is with address registers a0-a7.

5
  • 1
    hex-rays.com/products/ida/6.9 BUGFIX: mc68k: address bus width for mc68000, mc68010, cpu32 reduced to 24 bits
    – Igor Skochinsky
    Jul 13, 2016 at 10:05
  • @IgorSkochinsky Thanks! You should make it an answer, I will accept it unless somebody else comes along with some clever work-around. Jul 13, 2016 at 11:59
  • @IgorSkochinsky By the way, I was not able to find documentation online about "mapaddr". What does it do? I saw it was used in the Tricore definition. Jul 13, 2016 at 12:01
  • @IgorSkochinsky problem was solved not correctly. In 6.95 IDA some jumps becomes not recognized (contact me with PM, and I send you example). And mapaddr is just internally used in Tricore. Mar 19, 2017 at 14:08
  • @Dr.MefistO please send a report to support, thanks.
    – Igor Skochinsky
    Mar 19, 2017 at 19:02

1 Answer 1

1

support for 24-bit address space for 68k has been added in IDA 6.9: https://www.hex-rays.com/products/ida/6.9/

BUGFIX: mc68k: address bus width for mc68000, mc68010, cpu32 reduced to 24 bits

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.