0

I'm disassembling a game which runs on an Intel i960 processor. My disassembly is at a point I would like to try to reassemble it from an IDA Pro generated ASM file. The ASM file needs slight manipulation for the binutils 2.16.1a i960-coff targeted assembler to work, however there seems to be an instruction, with similar instructions to follow but the assembler segfaults after this instruction, which cannot be reassembled.

The instruction is as follows: "stt r12, (g11)[g12]"

A git which shows the switch statement which defaults to the error can be found here. A colleague of mine explains that the error around the scale field is because the scale factor isn't 1, 2, 4, 8,or 16. The scale factor is only three bits, and he hypothesizes that this most likely is Register Indirect with Index form.

From a programming manual:

The st, stl, stt, and stq instructions copy 4, 8, 12, and 16 bytes from successive registers into memory. ... Floating-point values are loaded from memory into global or local registers using the load (ld), load long (ldl), and load triple (ldt) instructions. Likewise, floating-point values in global or local registers are stored in memory using the store (st), store long (stl), and store triple (stt) instructions. ... The st, stl, stt, and stq instructions copy 4, 8, 12, and 16 bytes, respectively, from successive registers to memory. For the stt instruction, src must specify an even numbered register (e.g., gO, g2, ... , gI2). For the stt and stq instructions, src must specify a register number that is a multiple of four (e.g., gO, g4, g8).

I, however, have a feeling that it might be a Register Indirect with index and displacement. The reason being is that the instruction can also be disassembled as ""stt r12, (g11)[g12*1]" and a manual lists a Register Indirect with index and displacement example in assembler syntax as:

exp (reg) [reg*scale]

But if that were the case, the scale would be 1. I am at somewhat of a loss and wish to pick the minds of the reverse engineering stack exchange to see what information may arise. It may be just that the game company had their own assembler and special knowledge on the processor that was not public or published.

  • What are the instruction bytes and can you reproduce it with the assembler you have? – Igor Skochinsky May 30 at 16:52
  • The instruction bytes are A2 66 DC 1C. Reproducing those bytes from assembly might be a good idea, and will take some trial and error, however, I have replaced the instruction with the following .long 0xA266DC1C for now and the compiler seems to think that's fine. Will experiment with instructions to result in the same hex, however. – MrFreeman May 31 at 21:23
1

I think IDA simply omits the scale factor 1 to simplify the output and bring the syntax closer to other processors. The main goal of IDA is understanding code, not reassembly.

| improve this answer | |
  • Just as another data point, my Ghidra 80960 module was implemented by scraping binutils while referencing a manual, so it would have the multiply present. I can't recall an exact instruction, but feel like I have seen other Ghidra instructions that had these sort of simplifications as maybe unofficial psuedo-instructions. In Ghidra's case it can also assemble, so matching syntax when possible is beneficial to avoid having to handle all the cases – mumbel Jun 4 at 4:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.