Inferno #06 03 декабря 2004

Программирование

For Coderz - Decompiling programs - the revival of the old prog.

   Decompilation of programs

         Revive the old program!



   Many have long been initiated projects idle. Authors, 
forever leaving a Down throw their utility, and spit on the 
user and erase the source. Your soul is aching for these 
programs? Sometimes not enough seemingly small things 
differently, written Mountains code re-do the same thing 
offensively ... 


   So, long ago there is an opportunity to revive anyone ever 
written ZX Spectrum for the project!




   Not much emphasis is given to the fact
that (and because many do not know or do not represent in 
volume) now existing sources ALASM, PT3, PkUnZip, UnRar, RIP, 
Pusher - decompiled. Version of the ZX Word, adapted ZS'om from 
Samara, based on the author's decompiled code that ZS, however, 
does not spread. ZIP-depakera engine in his own MMCM player is 
also based on decompiled code, which is too long

not distributed (by Volga Soft). JPEGIF
laboratory of Sam Style began with decompilation JPEG viewer by 
Alien Factory. AND so on. Sometimes decompile occurred

due to a misunderstanding of the fact that the source
were considered lost (in the JPEG engine JPEGIF,
UnRar). Authors rarely recovers its
program accidentally overwritten (Pusher). Sometimes the old 
sources because of the greed of their holders proved obsolete, 
because program many times and broke the finishing straight to 
machine code, without source (ALASM). In the latter case is

Tip: if something appends to
machine code, ogranizuyte all these changes in the form of 
source code (INCBIN original code, then a lot of ORG with 
pieces of programs) and even then they all will not find when 
you are camping this source! 

   Generally, the source may be
most strange events - such as my source Worms demo once 
transferred from MASM in ALASM manual copying on paper, then 
with a piece of paper. Sometimes, disappears one module of 
source code on the disk of the author (EWS v1.1, STS v5.2). Or, 
again, the author no one knows where the source is lost entirely

(Hrip) ...


           Decompilation of the dump.


   Interrupt the boot the desired program
After unpacking all the code blocks, unload the main block of 
code (the program as any) to the desired starting address. This

block you will decompile. How to stop boot - another 
tema.Obychno system programs are not protected enough to load 
BASIC in the STS, to find the entrance and exit, then put a 
breakpoint on the exit. If you have a shadow debugger (STS in 
the ROM shadow service minitor or Unreal Speccy), it is even 
easier. Program during the better not to upload - it can be in 
this while defective, with the destruction of the 
initialization, wrong content variables, etc. 

   If a program uses sophisticated
structures that are likely to lie outside of the program (for 
example, the headline format, which operates the program - both 
in PT3), add zeros to the end of this code block. And that then 
have to manually search for all references to variables outside 
of the program, elementary possible some miss, and the 
structure becomes unmovable! 

   Get the code block in the ZX Turbo Disassembler (ZXD) by 
Alex Inozemtsev. There are 2 versions ZXD: 1.0 (authoring, 
unloads a ZX-ASM, more precisely, in the text with tabs, 
special for ZX-ASM) and 1.1 (cracked by Viper / TL - unloads in 
ascii, but I do not like there colors). I tried

use the first, for example, to decompile Mr Gluk Reset Service, 
and the second - to decompile Pefrect Commander. STS'om

and DASM'om (by Jaguar / PHD) is better not to try - that 
memory for the label came to an end, you will be very 
unpleasant to find out when you already typed all the addresses 
of data blocks in program.


   So, what I mean. Mark means ZXD all the data (single-byte 
DEFB, double-byte DEFW and long loadable INCL), to distinguish 
them from the code Z80. 

   After the first crude arrangement of press
Make Labels on the menu, and on labels for certain
be able to find errors in your razbienii.Chem
the more you fix them back in ZXD, the less the need to 
manually transfer from assembler code, and vice versa on the 
next steps in ALASM. 


   Save the project just in case (there
and will lie your way to the partition) and the decompiled 
program to disk. 

   If you enjoyed ZXD 1.0, then the texts
need to be translated into normal form, replacing
Custom ZX-ASM'ovskie tabs with spaces. This can be done in 
ACEdit (I did therein).



             Renewal of the dump.


   Received a lot of texts to download
ALASM teams impOrt. It is advisable to load them into memory 
all at once. Each file takes slightly less than half 
ALASM'ovskoy pages, but combine them with the reserve -

approximately half the file on the page,
as they swell to comment and long labels. Cut on the Limits of 
the procedures. 

   More procedures, which will find (if
not initially clear, then all tags
standing after RET absolute and unconditional JR / JP), mark 
the "bookmarked" by separating label procedures to 
stroki.Perehodit between They can be the cursor in Ext + L.


   While you are walking on the program from end to end, notice 
neoptimizirovannosti, Unused parts and repetitions, was 
isolated from the line shift to the right (this I select the 
right, and you can differently). 

   Changes nothing in the program will now!
On the contrary, periodically check that the code block that 
you get when you assemble, identical to the one you dumped on 
the ground etape.Dlya There are several programs "File 
Comparer". I take such a program from Mayhem. Previously, 
compared with writing a piece of code with XOR (Inconvenient, 
when the unit takes more than half the memory). PT3 (most of my 
first decompilation), I did not compare. Because of this

retained more than a hundred versions of the intermediate
decompiled source code (Hard to suddenly
into misery or something - where to get, with what
check?) Then during the heap versions shoveled errors. The 
lesson to me and you. 


   Separately from the previous step (before
or after, but not both - distracted, as if chasing two hares)
translate all the constants in a convenient and understandable 
form. If the constant is used in Playing as a character, then 
let it be the letter (ZXD default does so), otherwise the 
number. Sometimes decimal understandable 16-ary. On

amateur - binary. Naturally, the extra
zeros after the # is also no good.

   In ZXD error - negative bias
for IX and IY had increased by 256. Not
surprised if will not compile. May still need to replace the XH
HX and the like.


   To find out what all the encountered tag frequency 
ispolzovaniya.Eto done as follows: replace the symbol L in the 
label name to something another, and recompile. (You can

for several labels, if compiled for a long time. An emulator 
with the turbo button things quickly.) then recover, as it was.

Result (how many times have popped up an error)
that he was not gone, write over metkoy.Vot
as follows:

3
L867F



   2 error "not defined" and "wrong short"
should be considered for one. If the error
eye for more than 10, then write "many", it is
easier than figuring out how many exactly. If
number is small, then the mark may be
local to this procedure (check
replacing it with the name of the place and the immediate 
appeals and recompile), then mark it as follows: 

_867F


   (And remove the number - it was not for local
useful). For non-local labels figure
1 or 2 may mean that the procedure is highlighted in the 
process uneconomical. But in each If necessary to estimate and 
compare the length code subroutine outside a subroutine and 
contributed by inline (instead of calling for CALL simply write 
its contents). 


   Tags, which are completely understood (such as
CLS procedures and DHL), rename, replace
all calls through a search and replace.


   Can run into the mark, standing with the imperfect is not 
the topic. They were there: 

  a) due to the fact that you have transferred manually
 piece of code in the data;

  b) due to the fact that some programs do not work melts with 
those addresses (DISP); 

  c) due to the fact that part of the program zati raetsya 
during the data; 

  d) due to the fact that it does not address and Cons tantalum 
(like # 7ffd); 

  e) ...

   In general, each case requires review.
Out in ALASM is a function of the text search.
Just look for circulation to the label on all
program modules. If it's still DISP,
place an appropriate site as DISPENT, and labels will have to 
place (drag the program from other places because they 
Logically already somewhere defined) manually. 


   Sometimes, the label is used exclusively
in unused procedures of the program (they
could be in the code accidentally, even with
other system addresses! For example, the author does not
clear the memory when compiling), in which case tick mark 
somehow, then it can be removed. For example, all such labels, 
as well as addresses of data external to to the program, I put 
at the beginning of the first (main) source. 


   Variables in the body of the program ZXD draws as follows:



        LD BC, 0
L67B4 EQU $ - # 0002
L67B5 EQU $ - # 0001


   Them, I usually corrects for this:

L67B4 = $ +1
 L67B5 = $ +2

        LD BC, 0


   However, the label L67B5, if it is used in the program only 
once, it is better to this place is replaced by the expression 
L67B4 +1. Similarly, for external data (where the adjacent 
addresses can be identified, for example, when cleaning 
LDIR'om. It makes sense to call labeled only at this address 
less cleaning). 


   In no case can automate these processes. Because at the time 
they you become acquainted with programmoy.Programma thing

thin. Program must be understood.


   As a result, you will probably be moved (check by running 
with different number of NOP'ov in different places), however, 
obscure ishodnik.No, since he had already issued convenient to 
use (similar to a program, not the dump), to understand it 
better. Usually at spaced markers in the middle Programme for 
7000 lines (somewhere 900 marks) takes a couple of weeks. This 
is quite a creative process, but it almost always is. Can leave 
some procedures without a name, if your planned changes in 
program must be in other places. Then he will understand, in 
the optimization process (Because you are some stations have 
already tagged shift to the right - to optimize?) and 
navorachivaniya. 

   All changes in the initial stage (when
you are still not very understand the program and
it may worsen) mark, for example,
shift lines to the left. Again, this is my
personal way, but it paid off. I mark the shifts and changes in 
their own programs, and retracts the line back then, when sure 
of their correctness and optimality. 



   A month later, the decompiled source code
no one is distinguished by the type of avtorskogo.Zhelatelno 
its spread, as you yourself can also score for the project as a 
writer. 

A. Coder