radare2 - любопытный фреймворк для реверса и AI декомпиляции с поддержкой Z80
Наткнулся на любопытный фреймворк radare2 для реверса и декомпиляции бинарников:
https://en.wikipedia.org/wiki/Radare2
Поддерживает разные плагины для декомпиляции, в том числе ghidra и AI декомпиляцию в си.
Ктото уже пробовал натравливать на спектрум код?
Попробовал встроенным декомпилятором pdc, вывод тяжел для чтения, вот что выдает на ROM48:
Код:
$ r2 -a z80 -b 8 48.rom
[0x00000000]> aa
INFO: Analyze all flags starting with sym. and entry0 (aa)
INFO: Analyze imports (af@@@i)
WARN: select the calling convention with `e anal.cc=?`
INFO: Analyze symbols (af@@@s)
INFO: Recovering variables (afva@@@F)
INFO: Analyze all functions arguments/locals (afva@@@F)
[0x00000000]> pdc
int fcn.00000000 (int af, int bc) {
loc_0x00000000:
di
a = a ^
de = 0xffff
goto [0x11cb]
loc_0x000011cb:
// CODE XREF from fcn.00000000 @ 0x5(x)
b = a
a = 0x07
out [0xfe] a
a = 0x3f
i = a
h = d
l = e
return;
loc_0x000011dc: // orphan
[hl] = 0x02
dec hl
cp h
goto loc_0x000011dc
loc_0x000011e2: // orphan
a = a &
hl = hl - de
hl = hl + de
inc hl
loc_0x000011ef: // orphan
dec hl
exx
[0x5cb4] = bc // [0x5cb4:2]=0xffff
[0x5c38] = de // [0x5c38:2]=0xffff
[0x5c7b] = hl // [0x5c7b:2]=0xffff
exx
inc b
loc_0x00001219: // orphan
[0x5cb2] = hl // [0x5cb2:2]=0xffff
hl = 0x3c00
[0x5c36] = hl // [0x5c36:2]=0xffff
hl = [0x5cb2] // [0x5cb2:2]=0xffff
[hl] = 0x3e
dec hl
sp = hl
dec hl
dec hl
[0x5c3d] = hl // [0x5c3d:2]=0xffff
im 1
iy = 0x5c3a
ei
hl = 0x5cb6
[0x5c4f] = hl // [0x5c4f:2]=0xffff
de = 0x15af
bc = 0x0015
swap(de hl)
ldir
swap(de hl)
dec hl
[0x5c57] = hl // [0x5c57:2]=0xffff
inc hl
[0x5c53] = hl // [0x5c53:2]=0xffff
[0x5c4b] = hl // [0x5c4b:2]=0xffff
[hl] = 0x80
inc hl
[0x5c59] = hl // [0x5c59:2]=0xffff
[hl] = 0x0d
inc hl
[hl] = 0x80
inc hl
[0x5c61] = hl // [0x5c61:2]=0xffff
[0x5c63] = hl // [0x5c63:2]=0xffff
[0x5c65] = hl // [0x5c65:2]=0xffff
a = 0x38
[0x5c8d] = a // [0x5c8d:1]=255
[0x5c8f] = a // [0x5c8f:1]=255
[0x5c48] = a // [0x5c48:1]=255
hl = 0x0523
[0x5c09] = hl // [0x5c09:2]=0xffff
dec [iy+0xc6]
dec [iy+0xca]
hl = 0x15c6
de = 0x5c10
bc = 0x000e
ldir
set 1 [iy+0x01]
call 0x0edf // 0xedf(0x0, 0x0, 0x0, 0x0)
[iy+0x31] = 0x02
call 0x0d6b // 0xd6b(0x0, 0x0, 0x0, 0x0)
a = a ^
de = 0x1538
call 0x0c0a // 0xc0a(0x0, 0x0, 0x0, 0x0)
set 5 [iy+0x02]
loc_0x000012a9: // orphan
// CODE XREF from fcn.00000000 @ 0x12a0(x)
call 0x16b0 // 0x16b0(0x0, 0x0, 0x0, 0x0)
goto loc_0x000012ac
loc_0x000012cf: // orphan
hl = [0x5c59] // [0x5c59:2]=0xffff
[0x5c5d] = hl // [0x5c5d:2]=0xffff
call 0x19fb // 0x19fb(0x0, 0x0, 0x0, 0x0)
a = b
c = c |
loc_0x0000155d: // orphan
[0x5c49] = bc // [0x5c49:2]=0xffff
hl = [0x5c5d] // [0x5c5d:2]=0xffff
swap(de hl)
hl = 0x1555
push hl
hl = [0x5c61] // [0x5c61:2]=0xffff
scf
hl = hl - de
push hl
h = b
l = c
call 0x196e // 0x196e(0x0, 0x0, 0x0, 0x0)
loc_0x0000157d: // orphan
pop bc
a = c
dec a
b = b |
loc_0x000015ab: // orphan
pop af
loc_0x000012a2: // orphan
// CODE XREF from fcn.00000000 @ 0x15ac(x)
[iy+0x31] = 0x02
call 0x1795 // 0x1795(0x0, 0x0, 0x0, 0x0)
goto loc_0x000012a9
loc_0x000012bd: // orphan
bit 4 [iy+0x30]
loc_0x00001303: // orphan
halt
return;
loc_0x000012c3: // orphan
hl = [0x5c59] // [0x5c59:2]=0xffff
call 0x11a7 // 0x11a7(0x0, 0x0, 0x0, 0x0)
[iy+0x00] = 0xff
loc_0x000012ac: // orphan
// CODE XREF from fcn.00000000 @ 0x12cd(x)
a = 0x00
call 0x1601 // 0x1601(0x0, 0x0, 0x0, 0x0)
call 0x0f2c // 0xf2c(0x0, 0x0, 0x0, 0x0)
call 0x1b17 // 0x1b17(0x0, 0x0, 0x0, 0x0)
bit 7 [iy+0x00]
goto loc_0x000012cf
loc_0x00001583: // orphan
push bc
inc bc
inc bc
inc bc
inc bc
dec hl
de = [0x5c53] // [0x5c53:2]=0xffff
push de
call 0x1655 // 0x1655(0x0, 0x0, 0x0, 0x0)
pop hl
[0x5c53] = hl // [0x5c53:2]=0xffff
pop bc
push bc
inc de
hl = [0x5c61] // [0x5c61:2]=0xffff
dec hl
dec hl
lddr
hl = [0x5c49] // [0x5c49:2]=0xffff
swap(de hl)
pop bc
[hl] = b
dec hl
[hl] = c
dec hl
[hl] = e
dec hl
[hl] = d
goto loc_0x000015ab
loc_0x00001577: // orphan
call 0x19b8 // 0x19b8(0x0, 0x0, 0x0, 0x0)
call 0x19e8 // 0x19e8(0x0, 0x0, 0x0, 0x0)
goto loc_0x0000157d
loc_0x000012dd: // orphan
rst 0x18 // 0 = unknown ()
cp 0x0d
goto loc_0x000012a2
loc_0x000012e2: // orphan
bit 0 [iy+0x30]
call nz 0x0daf
call 0x0d6e // 0xd6e(0x0, 0x0, 0x0, 0x0)
a = 0x19
[iy+0x4f] = [iy+0x4f] -
[0x5c8c] = a // [0x5c8c:1]=255
set 7 [iy+0x01]
[iy+0x00] = 0xff
[iy+0x0a] = 0x01
call 0x1b8a // 0x1b8a(0x0, 0x0, 0x0, 0x0)
goto loc_0x00001303
loc_0x00001200: // orphan
[0x5cb4] = hl // [0x5cb4:2]=0xffff
de = 0x3eaf
bc = 0x00a8
swap(de hl)
lddr
swap(de hl)
inc hl
[0x5c7b] = hl // [0x5c7b:2]=0xffff
dec hl
bc = 0x0040
[0x5c38] = bc // [0x5c38:2]=0xffff
goto loc_0x00001219
loc_0x000011e9: // orphan
dec [hl]
goto loc_0x000011ef
loc_0x000011ec: // orphan
dec [hl]
goto loc_0x000011e2
}
С AI пока не разобрался, но подозреваю мой комп не потянет.
