I'm trying to disassemble some Sega Master System roms.

In order to do so, I've checked for the extra 512 bytes from old roms and once I was sure they weren't there, I proceeded to run radare2 on one of them, like so:

r2 -A somerom.sms

Radare2 correctly detects the file signature and loads it as z80 code, however when I go into visual mode, it shows the instructions as byte wide offsets (adding a lot of garbage instructions at each invalid address) but the z80 pc has 2 bytes wide steps/instructions.

My question would be: Is there a way to filter those extra addresses so the code can be displayed correctly?

I've tried using:

r2 -A -b 16 somerom.sms

but it doesn't change anything.

  • radare2 foo.sms -> aa-> viVV should show the disassembly if that is what youmean
    – blabb
    Commented Feb 11, 2020 at 18:50
  • I’m able to see the disassembly, I just don’t see the instructions correctly; Instead of getting 16bit-wide steps, I’m getting 8bit-wide steps. For example, instead of getting the instructions: DI; LD SP, 0xC0FF; IM 1; I get: DI; RST 38; RET NZ; IM 1. Of course, I’m using VV. Does viVV correct this behavior?
    – gb_away
    Commented Feb 11, 2020 at 20:30

1 Answer 1


as i commented radare2 opens an sms file without problem if you are not using the latest version try updating radare2 or downgrading to an older version

output below isfrom 3.3.0 the last 32 bit version of radare2

:\>radare2 -q -c "aa;pd 10" ak.sms
Checksum: 0x1cd0
ProductCode: 005067
Console: Sega Master System
Region: Export
RomSize: 128KB
/ (fcn) fcn.00000000 85
|   fcn.00000000 ();
|           0x00000000      f3             di
|           0x00000001      ed56           im 1
|           0x00000003      31f0df         ld sp, 0xdff0
|       ,=< 0x00000006      187d           jr 0x7d
        |   0x00000008      7b             ld a, e
        |   0x00000009      d3bf           out [0xbf], a
        |   0x0000000b      7a             ld a, d
        |   0x0000000c      d3bf           out [0xbf], a
        |   0x0000000e      c9             ret
        |   0x0000000f      ff             rst 0x38
  • Indeed, just using aa instead of aaa (or the command flag -A) makes radare2 load the disassembly correctly. Thanks.
    – gb_away
    Commented Feb 12, 2020 at 22:19
  • @gb_away maybe there's something with that binary - I've tried on one I have and there was no difference between the two approaches. Commented Feb 13, 2020 at 17:29
  • @PawełŁukasik indeed. I’ve compiled and linked a test myself with wla dx and it showed up just fine, even using aaa.
    – gb_away
    Commented Feb 14, 2020 at 17:35
  • [cont] So, beats me. The game I was trying to disassemble was doki doki penguin land. Very odd.
    – gb_away
    Commented Feb 14, 2020 at 17:38
  • @gb_away if you can, please provide the binary so we will be able to have a look at the exact issue :)
    – Megabeets
    Commented Mar 7, 2020 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.