2

Let's look at this very simple example: we have an AX (16-bit) register, which splits into two 8-bit registers: AH and AL (imagine x86). Then, imagine that these registers are memory mapped starting from RAM:0000 till RAM:0001 just like that:

AX - RAM:0x0000-0x0001
AH - RAM:0x0000
AL - RAM:0x0001

Is it possible to create a REG_DEFS for IDA Processor Module and then map it to the RAM segment in a way, that would allow tracking the registers in the correct order throughout the disassembly? The problem is, that commands such as mov could operate on both "a complete" register (AX) as well as its parts (AH and AL) and while creating a RAM mapping, it doesn't allow me to name the same area of RAM twice using this code:

# Creating AX
ida_bytes.create_data(0x0000, FF_WORD, 2, ida_idaapi.BADADDR)
idc.set_name(0x0000, "AX", SN_CHECK)

# This approach would fail, as it would intersect with AX and redefine it
ida_bytes.create_data(0x0000, FF_BYTE, 1, ida_idaapi.BADADDR)
idc.set_name(0x0000, "AH", SN_CHECK)
ida_bytes.create_data(0x0001, FF_BYTE, 1, ida_idaapi.BADADDR)
idc.set_name(0x0001, "AL", SN_CHECK)

So, I would either get AX in the disassembly listing or AH and AL, but not both. More than that:

  1. I need to be able to access individual bits within the AH and AL registers, therefore a simple UNION would not work I guess.
  2. IDA needs a way to understand that AH and AL are a part of the AX register and track not only their own values but a value as a part of AX as well. Example:

mov ax, 100h # AH should be 1h and AL should be 0

Is there a way to overcome it with the memory-mapped registers?

1
  • What's your precise goal? The reason I ask, is that Hex-Rays (the decompiler) actually models this and uses it to perform its decompilation. As you know, IDA's disassembler doesn't, but then the disassembler's goal is just to enable basic referencing and notations over the address-space. If you're trying to write a processor module, there's disassembler libs that you can use to access those relationships, but if you're just trying to ask questions about them while reversing...there's plugins that provide an interface that you can use for querying. Which one are you trying to do? Jun 29, 2023 at 14:55

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.