How can I disassemble a hex file?

Go To Last Post
13 posts / 0 new
Author
Message
#1
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

This is for the ATMEGA8 hex file. Is there is a really good disassembler?

Thanks

Last Edited: Sat. Apr 16, 2016 - 12:05 AM
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

AVRStudio

Why do you need to disassemble the hex. The source code tells all

I would rather attempt something great and fail, than attempt nothing and succeed - Fortune Cookie

 

"The critical shortage here is not stuff, but time." - Johan Ekdahl

 

"Step N is required before you can do step N+1!" - ka7ehk

 

"If you want a career with a known path - become an undertaker. Dead people don't sue!" - Kartman

"Why is there a "Highway to Hell" and only a "Stairway to Heaven"? A prediction of the expected traffic load?"  - Lee "theusch"

 

Speak sweetly. It makes your words easier to digest when at a later date you have to eat them ;-)  - Source Unknown

Please Read: Code-of-Conduct

Atmel Studio6.2/AS7, DipTrace, Quartus, MPLAB, RSLogix user

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

There have been some other threads about this. I recall one where I briefly outlined some of the things I do to reverse engineer a hex file. You might try searching the forum.

But Jim's right - the place to start is AVR Studio. Just open the hex file (File|Open) and it will magically disassemble it.

Chuck Baird

"I wish I were dumber so I could be more certain about my opinions. It looks fun." -- Scott Adams

http://www.cbaird.org

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

jgmdesign wrote:
AVRStudio

Why do you need to disassemble the hex. The source code tells all

If I had a the source, I wouldn't be disassembling the hex file.

Well, there is project on the net. The author simply post the hex and no explaining whatsoever how things work, thus, trying to understand his project by reverse engineering. :-)

And thanks for the answers, Jim & Chuck!

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Perhaps there is a reason that the author did not want people to have the source code?

Regards,
Steve A.

The Board helps those that help themselves.

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

avr-objdump -m avr -D file.hex

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Search for ReAVR from Johannes Assenbaum. It will create named labels, konstants, mark jumps and branches, whatever. I've used it several times and it worked perfectly for me.

Einstein was right: "Two things are unlimited: the universe and the human stupidity. But i'm not quite sure about the former..."

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Quote:

avr-objdump -m avr -D file.hex

Perhaps even:

avr-objdump --no-show-raw-insn -m avr -D file.hex

One shows:

E:\avr>avr-objdump -m avr -D test.hex

test.hex:     file format ihex


Disassembly of section .sec1:

00000000 <.sec1>:
   0:   0c 94 2a 00     jmp     0x54    ;  0x54
   4:   0c 94 34 00     jmp     0x68    ;  0x68
   8:   0c 94 34 00     jmp     0x68    ;  0x68
   c:   0c 94 34 00     jmp     0x68    ;  0x68
  10:   0c 94 34 00     jmp     0x68    ;  0x68
  14:   0c 94 34 00     jmp     0x68    ;  0x68
  18:   0c 94 34 00     jmp     0x68    ;  0x68
  1c:   0c 94 34 00     jmp     0x68    ;  0x68
  20:   0c 94 34 00     jmp     0x68    ;  0x68
  24:   0c 94 34 00     jmp     0x68    ;  0x68
  28:   0c 94 34 00     jmp     0x68    ;  0x68
  2c:   0c 94 34 00     jmp     0x68    ;  0x68
  30:   0c 94 34 00     jmp     0x68    ;  0x68
  34:   0c 94 34 00     jmp     0x68    ;  0x68
  38:   0c 94 34 00     jmp     0x68    ;  0x68
  3c:   0c 94 34 00     jmp     0x68    ;  0x68
  40:   0c 94 34 00     jmp     0x68    ;  0x68
  44:   0c 94 34 00     jmp     0x68    ;  0x68
  48:   0c 94 34 00     jmp     0x68    ;  0x68
  4c:   0c 94 34 00     jmp     0x68    ;  0x68
  50:   0c 94 34 00     jmp     0x68    ;  0x68
  54:   11 24           eor     r1, r1
  56:   1f be           out     0x3f, r1        ; 63
  58:   cf e5           ldi     r28, 0x5F       ; 95
  5a:   d4 e0           ldi     r29, 0x04       ; 4
  5c:   de bf           out     0x3e, r29       ; 62
  5e:   cd bf           out     0x3d, r28       ; 61
  60:   0e 94 36 00     call    0x6c    ;  0x6c
  64:   0c 94 a3 00     jmp     0x146   ;  0x146

the other:

E:\avr>avr-objdump --no-show-raw-insn -m avr -D test.hex

test.hex:     file format ihex


Disassembly of section .sec1:

00000000 <.sec1>:
   0:   jmp     0x54    ;  0x54
   4:   jmp     0x68    ;  0x68
   8:   jmp     0x68    ;  0x68
   c:   jmp     0x68    ;  0x68
  10:   jmp     0x68    ;  0x68
  14:   jmp     0x68    ;  0x68
  18:   jmp     0x68    ;  0x68
  1c:   jmp     0x68    ;  0x68
  20:   jmp     0x68    ;  0x68
  24:   jmp     0x68    ;  0x68
  28:   jmp     0x68    ;  0x68
  2c:   jmp     0x68    ;  0x68
  30:   jmp     0x68    ;  0x68
  34:   jmp     0x68    ;  0x68
  38:   jmp     0x68    ;  0x68
  3c:   jmp     0x68    ;  0x68
  40:   jmp     0x68    ;  0x68
  44:   jmp     0x68    ;  0x68
  48:   jmp     0x68    ;  0x68
  4c:   jmp     0x68    ;  0x68
  50:   jmp     0x68    ;  0x68
  54:   eor     r1, r1
  56:   out     0x3f, r1        ; 63
  58:   ldi     r28, 0x5F       ; 95
  5a:   ldi     r29, 0x04       ; 4
  5c:   out     0x3e, r29       ; 62
  5e:   out     0x3d, r28       ; 61
  60:   call    0x6c    ;  0x6c
  64:   jmp     0x146   ;  0x146

As you'll be using the call/jmp target addresses as labels (I assume?) you might want to use --prefix-addresses too:

0x00000000 jmp  0x54    ;  0x00000054
0x00000004 jmp  0x68    ;  0x00000068
0x00000008 jmp  0x68    ;  0x00000068
0x0000000c jmp  0x68    ;  0x00000068
0x00000010 jmp  0x68    ;  0x00000068
0x00000014 jmp  0x68    ;  0x00000068
0x00000018 jmp  0x68    ;  0x00000068
0x0000001c jmp  0x68    ;  0x00000068
0x00000020 jmp  0x68    ;  0x00000068
0x00000024 jmp  0x68    ;  0x00000068
0x00000028 jmp  0x68    ;  0x00000068
0x0000002c jmp  0x68    ;  0x00000068
0x00000030 jmp  0x68    ;  0x00000068
0x00000034 jmp  0x68    ;  0x00000068
0x00000038 jmp  0x68    ;  0x00000068
0x0000003c jmp  0x68    ;  0x00000068
0x00000040 jmp  0x68    ;  0x00000068
0x00000044 jmp  0x68    ;  0x00000068
0x00000048 jmp  0x68    ;  0x00000068
0x0000004c jmp  0x68    ;  0x00000068
0x00000050 jmp  0x68    ;  0x00000068
0x00000054 eor  r1, r1
0x00000056 out  0x3f, r1        ; 63
0x00000058 ldi  r28, 0x5F       ; 95
0x0000005a ldi  r29, 0x04       ; 4
0x0000005c out  0x3e, r29       ; 62
0x0000005e out  0x3d, r28       ; 61
0x00000060 call 0x6c    ;  0x0000006c

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Well, let's see.

It writes 0's to port 3f,
then 04 to port 3e,
then 5F to port 3d.

Then it calls a subroutine at 6c that you didn't include. You'll have to dig through the data sheet to see what ports 3f, 3e and 3d are.

If you don't know my whole story, keep your mouth shut.

If you know my whole story, you're an accomplice. Keep your mouth shut. 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Torby wrote:
You'll have to dig through the data sheet to see what ports 3f, 3e and 3d are.
Those ports have the same function on every AVR - SREG, SPH, SPL. Of course, ther ports vary by device or by group of devices.

Don Kinzer
ZBasic Microcontrollers
http://www.zbasic.net

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

DO1THL wrote:
Search for ReAVR from Johannes Assenbaum. It will create named labels, konstants, mark jumps and branches, whatever. I've used it several times and it worked perfectly for me.

Thanks! And the link is https://www.avrfreaks.net/index.p...

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

dkinzer wrote:
Torby wrote:
You'll have to dig through the data sheet to see what ports 3f, 3e and 3d are.
Those ports have the same function on every AVR - SREG, SPH, SPL. Of course, ther ports vary by device or by group of devices.

hehe I haven't compared near enough datasheets to know that.

If you don't know my whole story, keep your mouth shut.

If you know my whole story, you're an accomplice. Keep your mouth shut. 

  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

Torby wrote:
I haven't compared near enough datasheets to know that.
On further thought, my statement was a bit too broad. On devices with 256 bytes or less of RAM, there is no SPH register. But on those devices that have one, it is located at 0x3e.

Don Kinzer
ZBasic Microcontrollers
http://www.zbasic.net

Topic locked