Author Topic: PRIZM Disassembler (Read 35006 times)

Munchor · « **Reply #15 on:** January 18, 2011, 07:54:32 am »

Mine already reads .g3a files, but disassembling them will return weird results until PRIZM Assembly is discovered :S

fxdev · « **Reply #16 on:** January 18, 2011, 10:18:51 am »

One question: Why aren't you using IDA Pro Advanced for this?
Simply open the add-in file and select SH3B as the processor type.

A cracked version is available here (v5.5): ~~no.links2piratedprograms.plz~~

Offset 0x7000..0x7044 with IDA:

Code: [Select]

ROM:00007000 loc_7000:                               ; DATA XREF: ROM:0009DFFC
ROM:00007000                                         ; ROM:0009E17C
ROM:00007000                 mov.l   r14, @-r15
ROM:00007002                 sts.l   pr, @-r15
ROM:00007004                 add     #-4, r15
ROM:00007006                 mov.l   r4, @r15
ROM:00007008                 mov.l   dword_7028, r3 ; h'300034
ROM:0000700A                 jsr     @r3
ROM:0000700C                 mov     r5, r14
ROM:0000700E                 mov.l   dword_702C, r1 ; h'38DF00
ROM:00007010                 mov     #1, r6
ROM:00007012                 mov     #0, r4
ROM:00007014                 jsr     @r1
ROM:00007016                 mov     r6, r5
ROM:00007018                 mov.l   dword_7030, r7 ; h'33767C
ROM:0000701A                 extu.w  r14, r5
ROM:0000701C                 mov.l   @r15, r4
ROM:0000701E                 add     #4, r15
ROM:00007020                 lds.l   @r15+, pr
ROM:00007022                 jmp     @r7
ROM:00007024                 mov.l   @r15+, r14
ROM:00007024 ; ---------------------------------------------------------------------------
ROM:00007026                 .align 4
ROM:00007028 dword_7028:     .data.l h'300034        ; DATA XREF: ROM:00007008
ROM:0000702C dword_702C:     .data.l h'38DF00        ; DATA XREF: ROM:0000700E
ROM:00007030 dword_7030:     .data.l h'33767C        ; DATA XREF: ROM:00007018
ROM:00007034 ; ---------------------------------------------------------------------------
ROM:00007034                 mov.l   dword_706C, r7 ; h'38FE4C
ROM:00007036                 mov     #0, r6
ROM:00007038                 mov.l   dword_7070, r4 ; h'38FE50
ROM:0000703A                 bra     loc_7042
ROM:0000703C                 mov.l   @r7, r2
ROM:0000703E ; ---------------------------------------------------------------------------
ROM:0000703E
ROM:0000703E loc_703E:                               ; CODE XREF: ROM:00007046
ROM:0000703E                 mov.l   r6, @r2
ROM:00007040                 add     #4, r2
ROM:00007042
ROM:00007042 loc_7042:                               ; CODE XREF: ROM:0000703A
ROM:00007042                 mov.l   @r4, r5
ROM:00007044                 cmp/hs  r5, r2

JosJuice · « **Reply #17 on:** January 18, 2011, 11:07:24 am »

Please don't post links to cracked versions.

AngelFish · « **Reply #18 on:** January 18, 2011, 11:58:20 am »

We aren't using it because no one should have to download illegally obtained software just to look at their Prizm or participate in discussions of it. The whole point of developing more disassemblers is to *avoid* having to use commercial software. Indeed, that's the whole point of Gnu.

DJ Omnimaga · « **Reply #19 on:** January 18, 2011, 12:17:44 pm »

What both users above said. I don't want to get in trouble with my web hosting provider. Also I don't trust pirated softwares anymore because several contains viruses that only gets detected one year later (like a time bomb). However, we shouldn't have to pay to develop softwares IMHO so the community will write freeware tools to do so.

When TI decided to make people pay for the TI-83 Plus SDK in the early 2000s, people just ported TASM and Devpac8x to the 83 Plus to develop for free. Later, TI made the SDK free, though.

Anyway welcome here.

Munchor · « **Reply #20 on:** January 18, 2011, 03:06:25 pm »

Quote from: cfxm on January 18, 2011, 10:18:51 am

Simply open the add-in file and select SH3B as the processor type.
Offset 0x7000..0x7044 with IDA:

Code: [Select]
ROM:00007000 loc_7000: ; DATA XREF: ROM:0009DFFC ROM:00007000 ; ROM:0009E17C ROM:00007000 mov.l r14, @-r15 ROM:00007002 sts.l pr, @-r15 ROM:00007004 add #-4, r15 ROM:00007006 mov.l r4, @r15 ROM:00007008 mov.l dword_7028, r3 ; h'300034 ROM:0000700A jsr @r3 ROM:0000700C mov r5, r14 ROM:0000700E mov.l dword_702C, r1 ; h'38DF00 ROM:00007010 mov #1, r6 ROM:00007012 mov #0, r4 ROM:00007014 jsr @r1 ROM:00007016 mov r6, r5 ROM:00007018 mov.l dword_7030, r7 ; h'33767C ROM:0000701A extu.w r14, r5 ROM:0000701C mov.l @r15, r4 ROM:0000701E add #4, r15 ROM:00007020 lds.l @r15+, pr ROM:00007022 jmp @r7 ROM:00007024 mov.l @r15+, r14 ROM:00007024 ; --------------------------------------------------------------------------- ROM:00007026 .align 4 ROM:00007028 dword_7028: .data.l h'300034 ; DATA XREF: ROM:00007008 ROM:0000702C dword_702C: .data.l h'38DF00 ; DATA XREF: ROM:0000700E ROM:00007030 dword_7030: .data.l h'33767C ; DATA XREF: ROM:00007018 ROM:00007034 ; --------------------------------------------------------------------------- ROM:00007034 mov.l dword_706C, r7 ; h'38FE4C ROM:00007036 mov #0, r6 ROM:00007038 mov.l dword_7070, r4 ; h'38FE50 ROM:0000703A bra loc_7042 ROM:0000703C mov.l @r7, r2 ROM:0000703E ; --------------------------------------------------------------------------- ROM:0000703E ROM:0000703E loc_703E: ; CODE XREF: ROM:00007046 ROM:0000703E mov.l r6, @r2 ROM:00007040 add #4, r2 ROM:00007042 ROM:00007042 loc_7042: ; CODE XREF: ROM:0000703A ROM:00007042 mov.l @r4, r5 ROM:00007044 cmp/hs r5, r2

The thing is, we need to know PRIZM Assembly to make a disassembler. PRIZM Assembly is not the same as all SH3 Assembly, AFAIK. Not every machines with the same processor work the same way, I guess. Also, I believe it won't take much time for Qwerty and other Prizm hackers to start coding Asm

z80man · « **Reply #21 on:** January 18, 2011, 07:44:45 pm »

I tried making a new app. I'm not sure if it actually worked, but it was less tragic than the last one. The goal was to wait several seconds/minutes then return to the OS. When running the screen went blank for about 15 seconds and then the calc went to the setup screen. I believe there was a ram reset, but the target/PC screen never showed up. Here is the code and actual app.

Code: [Select]

File size: 29180
00007000: MOV.L @($01*4+PC),R15 = #FFFFFFFF
00007002: DT R15
00007004: BF $7002
00007006: RTS
00007008: .data ffffffff dword ref:7000

bsl · « **Reply #22 on:** January 19, 2011, 01:42:35 am »

I am not sure you can use RTS to get back to the OS.
Disassemble the small Conv.g3a - there is only one RTS (at $7068) and its the applications subroutine.
Also as a note it makes sense that application file offset 0x7000 in memory has the PC value of 0x300000
then the program subroutine addresses match. The OS calls seem to be at > 0x80000000 .
The only reason I left out the register values in the disassembler is that I did not know there initial values.
Now it looks like I will include them in the next version.

JosJuice · « **Reply #23 on:** January 19, 2011, 01:44:41 am »

Quote from: bsl on January 19, 2011, 01:42:35 am

I am not sure you can use RTS to get back to the OS.
Disassemble the small Conv.g3a - there is only one RTS (at $7068) and its the applications subroutine.

That makes sense... I remember that on the TI-83+/84+, programs are exited using RET, but apps have to be exited by using a certain OS call.

Munchor · « **Reply #24 on:** January 19, 2011, 11:10:38 am »

Small Update:

> Optimizations;
> Changed appearance slightly;
> Added 'About Box' to credit me, JosJuice and Goplat;
> Added link to Omnimaga 'Casio Prizm Discussion' forum;
> Added 'Load .g3a' option.

I still need to get authorization from administrator to link to Omnimaga (like I did with Assemblex), but I am in a rush now, so any admin could just answer in this topic.

AngelFish · « **Reply #25 on:** January 19, 2011, 11:14:05 am »

How do you run it from Command line?

Munchor · « **Reply #26 on:** January 19, 2011, 11:16:27 am »

Quote from: Qwerty.55 on January 19, 2011, 11:14:05 am

How do you run it from Command line?

You don't. I could, however, make a script to make it CMD, if someone wants to, but I don't really see why since GUI is much better.

JosJuice · « **Reply #27 on:** January 19, 2011, 11:19:20 am »

It seems like the .g3a reading still tries to read part of the header. And, um... disassembling doesn't seem to work at all.

Munchor · « **Reply #28 on:** January 19, 2011, 11:21:35 am »

Quote from: JosJuice on January 19, 2011, 11:19:20 am

It seems like the .g3a reading still tries to read part of the header. And, um... disassembling doesn't seem to work at all.

Of course not, PRIZM Assembly is not known yet, none can make a Disassembler, it only reads the Hex. Part of the header? Can you say how many bytes?

EDIT: I have found a file explaining SH3 Assembly, I'll make it read Hex ASAP:

AngelFish · « **Reply #29 on:** January 19, 2011, 11:25:44 am »

Scout, SH3 Assembly *is* known. I've explained why Enii is used instead of regular hex on IRC three times already.

Author Topic: PRIZM Disassembler (Read 35006 times)

Munchor

Re: PRIZM Disassembler

fxdev

Re: PRIZM Disassembler

JosJuice

Re: PRIZM Disassembler

AngelFish

Re: PRIZM Disassembler

DJ Omnimaga

Re: PRIZM Disassembler

Munchor

Re: PRIZM Disassembler

z80man

Re: PRIZM Disassembler

bsl

Re: PRIZM Disassembler

JosJuice

Re: PRIZM Disassembler

Munchor

Re: PRIZM Disassembler

AngelFish

Re: PRIZM Disassembler

Munchor

Re: PRIZM Disassembler

JosJuice

Re: PRIZM Disassembler

Munchor

Re: PRIZM Disassembler

AngelFish

Re: PRIZM Disassembler