How can I disassemble a hex file?

Topic locked
Go To Last Post
13 posts / 0 new
Author
Message
unebonnevie
unebonnevie's picture
Level: Resident
Joined: Thu. Oct 30, 2008
Posts: 752 View posts
#1
Posted by unebonnevie: Thu. Mar 22, 2012 - 12:20 AM
  • 1
  • 2
  • 3
  • 4
  • 5
Total votes: 0

This is for the ATMEGA8 hex file. Is there is a really good disassembler?

Thanks

Tags:

AVR Microcontrollers, megaAVR and tinyAVR
Last Edited: Sat. Apr 16, 2016 - 12:05 AM
    Top
    jgmdesign
    jgmdesign's picture
    Level: Moderator
    Joined: Mon. Mar 19, 2007
    Posts: 18675 View posts
    Location: Long Island New York
    Posted by jgmdesign: Thu. Mar 22, 2012 - 12:44 AM
    • 1
    • 2
    • 3
    • 4
    • 5
    Total votes: 0

    AVRStudio

    Why do you need to disassemble the hex. The source code tells all

    I would rather attempt something great and fail, than attempt nothing and succeed - Fortune Cookie

     

    "The critical shortage here is not stuff, but time." - Johan Ekdahl

     

    "Step N is required before you can do step N+1!" - ka7ehk

     

    "If you want a career with a known path - become an undertaker. Dead people don't sue!" - Kartman

    "Why is there a "Highway to Hell" and only a "Stairway to Heaven"? A prediction of the expected traffic load?"  - Lee "theusch"

     

    Speak sweetly. It makes your words easier to digest when at a later date you have to eat them ;-)  - Source Unknown

    Please Read: Code-of-Conduct

    Atmel Studio6.2/AS7, DipTrace, Quartus, MPLAB, RSLogix user

    Top
    zbaird
    zbaird's picture
    Level: Raving Lunatic
    Joined: Sun. Aug 13, 2006
    Posts: 7438 View posts
    Location: Bellingham, WA - USA
    Posted by zbaird: Thu. Mar 22, 2012 - 01:48 AM
    • 1
    • 2
    • 3
    • 4
    • 5
    Total votes: 0

    There have been some other threads about this. I recall one where I briefly outlined some of the things I do to reverse engineer a hex file. You might try searching the forum.

    But Jim's right - the place to start is AVR Studio. Just open the hex file (File|Open) and it will magically disassemble it.

    Chuck Baird

    "I wish I were dumber so I could be more certain about my opinions. It looks fun." -- Scott Adams

    http://www.cbaird.org

    Top
    unebonnevie
    unebonnevie's picture
    Level: Resident
    Joined: Thu. Oct 30, 2008
    Posts: 752 View posts
    Posted by unebonnevie: Thu. Mar 22, 2012 - 03:49 AM
    • 1
    • 2
    • 3
    • 4
    • 5
    Total votes: 0

    jgmdesign wrote:
    AVRStudio

    Why do you need to disassemble the hex. The source code tells all

    If I had a the source, I wouldn't be disassembling the hex file.

    Well, there is project on the net. The author simply post the hex and no explaining whatsoever how things work, thus, trying to understand his project by reverse engineering. :-)

    And thanks for the answers, Jim & Chuck!

    Top
    Koshchi
    Koshchi's picture
    Level: 10k+ Postman
    Joined: Wed. Nov 17, 2004
    Posts: 15658 View posts
    Location: Vancouver, BC
    Posted by Koshchi: Thu. Mar 22, 2012 - 04:05 AM
    • 1
    • 2
    • 3
    • 4
    • 5
    Total votes: 0

    Perhaps there is a reason that the author did not want people to have the source code?

    Regards,
    Steve A.

    The Board helps those that help themselves.

    Top
    westfw
    westfw's picture
    Level: Raving Lunatic
    Joined: Wed. Jun 19, 2002
    Posts: 5348 View posts
    Location: SF Bay area
    Posted by westfw: Thu. Mar 22, 2012 - 05:32 AM
    • 1
    • 2
    • 3
    • 4
    • 5
    Total votes: 0

    avr-objdump -m avr -D file.hex

    Top
    DO1THL
    DO1THL's picture
    Level: Posting Freak
    Joined: Thu. Aug 29, 2002
    Posts: 1404 View posts
    Location: Muenster, Germany
    Posted by DO1THL: Thu. Mar 22, 2012 - 09:32 AM
    • 1
    • 2
    • 3
    • 4
    • 5
    Total votes: 0

    Search for ReAVR from Johannes Assenbaum. It will create named labels, konstants, mark jumps and branches, whatever. I've used it several times and it worked perfectly for me.

    Einstein was right: "Two things are unlimited: the universe and the human stupidity. But i'm not quite sure about the former..."

    Top
    Gold Markclawson
    clawson's picture
    Level: Moderator
    Joined: Mon. Jul 18, 2005
    Posts: 104792 View posts
    Location: (using avr-gcc in) Finchingfield, Essex, England
    Posted by clawson: Thu. Mar 22, 2012 - 10:51 AM
    • 1
    • 2
    • 3
    • 4
    • 5
    Total votes: 0

    Quote:

    avr-objdump -m avr -D file.hex

    Perhaps even:

    avr-objdump --no-show-raw-insn -m avr -D file.hex

    One shows:

    E:\avr>avr-objdump -m avr -D test.hex

test.hex:     file format ihex


Disassembly of section .sec1:

00000000 <.sec1>:
   0:   0c 94 2a 00     jmp     0x54    ;  0x54
   4:   0c 94 34 00     jmp     0x68    ;  0x68
   8:   0c 94 34 00     jmp     0x68    ;  0x68
   c:   0c 94 34 00     jmp     0x68    ;  0x68
  10:   0c 94 34 00     jmp     0x68    ;  0x68
  14:   0c 94 34 00     jmp     0x68    ;  0x68
  18:   0c 94 34 00     jmp     0x68    ;  0x68
  1c:   0c 94 34 00     jmp     0x68    ;  0x68
  20:   0c 94 34 00     jmp     0x68    ;  0x68
  24:   0c 94 34 00     jmp     0x68    ;  0x68
  28:   0c 94 34 00     jmp     0x68    ;  0x68
  2c:   0c 94 34 00     jmp     0x68    ;  0x68
  30:   0c 94 34 00     jmp     0x68    ;  0x68
  34:   0c 94 34 00     jmp     0x68    ;  0x68
  38:   0c 94 34 00     jmp     0x68    ;  0x68
  3c:   0c 94 34 00     jmp     0x68    ;  0x68
  40:   0c 94 34 00     jmp     0x68    ;  0x68
  44:   0c 94 34 00     jmp     0x68    ;  0x68
  48:   0c 94 34 00     jmp     0x68    ;  0x68
  4c:   0c 94 34 00     jmp     0x68    ;  0x68
  50:   0c 94 34 00     jmp     0x68    ;  0x68
  54:   11 24           eor     r1, r1
  56:   1f be           out     0x3f, r1        ; 63
  58:   cf e5           ldi     r28, 0x5F       ; 95
  5a:   d4 e0           ldi     r29, 0x04       ; 4
  5c:   de bf           out     0x3e, r29       ; 62
  5e:   cd bf           out     0x3d, r28       ; 61
  60:   0e 94 36 00     call    0x6c    ;  0x6c
  64:   0c 94 a3 00     jmp     0x146   ;  0x146

    the other:

    E:\avr>avr-objdump --no-show-raw-insn -m avr -D test.hex

test.hex:     file format ihex


Disassembly of section .sec1:

00000000 <.sec1>:
   0:   jmp     0x54    ;  0x54
   4:   jmp     0x68    ;  0x68
   8:   jmp     0x68    ;  0x68
   c:   jmp     0x68    ;  0x68
  10:   jmp     0x68    ;  0x68
  14:   jmp     0x68    ;  0x68
  18:   jmp     0x68    ;  0x68
  1c:   jmp     0x68    ;  0x68
  20:   jmp     0x68    ;  0x68
  24:   jmp     0x68    ;  0x68
  28:   jmp     0x68    ;  0x68
  2c:   jmp     0x68    ;  0x68
  30:   jmp     0x68    ;  0x68
  34:   jmp     0x68    ;  0x68
  38:   jmp     0x68    ;  0x68
  3c:   jmp     0x68    ;  0x68
  40:   jmp     0x68    ;  0x68
  44:   jmp     0x68    ;  0x68
  48:   jmp     0x68    ;  0x68
  4c:   jmp     0x68    ;  0x68
  50:   jmp     0x68    ;  0x68
  54:   eor     r1, r1
  56:   out     0x3f, r1        ; 63
  58:   ldi     r28, 0x5F       ; 95
  5a:   ldi     r29, 0x04       ; 4
  5c:   out     0x3e, r29       ; 62
  5e:   out     0x3d, r28       ; 61
  60:   call    0x6c    ;  0x6c
  64:   jmp     0x146   ;  0x146

    As you'll be using the call/jmp target addresses as labels (I assume?) you might want to use --prefix-addresses too:

    0x00000000 jmp  0x54    ;  0x00000054
0x00000004 jmp  0x68    ;  0x00000068
0x00000008 jmp  0x68    ;  0x00000068
0x0000000c jmp  0x68    ;  0x00000068
0x00000010 jmp  0x68    ;  0x00000068
0x00000014 jmp  0x68    ;  0x00000068
0x00000018 jmp  0x68    ;  0x00000068
0x0000001c jmp  0x68    ;  0x00000068
0x00000020 jmp  0x68    ;  0x00000068
0x00000024 jmp  0x68    ;  0x00000068
0x00000028 jmp  0x68    ;  0x00000068
0x0000002c jmp  0x68    ;  0x00000068
0x00000030 jmp  0x68    ;  0x00000068
0x00000034 jmp  0x68    ;  0x00000068
0x00000038 jmp  0x68    ;  0x00000068
0x0000003c jmp  0x68    ;  0x00000068
0x00000040 jmp  0x68    ;  0x00000068
0x00000044 jmp  0x68    ;  0x00000068
0x00000048 jmp  0x68    ;  0x00000068
0x0000004c jmp  0x68    ;  0x00000068
0x00000050 jmp  0x68    ;  0x00000068
0x00000054 eor  r1, r1
0x00000056 out  0x3f, r1        ; 63
0x00000058 ldi  r28, 0x5F       ; 95
0x0000005a ldi  r29, 0x04       ; 4
0x0000005c out  0x3e, r29       ; 62
0x0000005e out  0x3d, r28       ; 61
0x00000060 call 0x6c    ;  0x0000006c

    Top
    Torby
    Torby's picture
    Level: 10k+ Postman
    Joined: Tue. Nov 11, 2003
    Posts: 10444 View posts
    Location: Bartlesville Oklahoma USA
    Posted by Torby: Thu. Mar 22, 2012 - 02:28 PM
    • 1
    • 2
    • 3
    • 4
    • 5
    Total votes: 0

    Well, let's see.

    It writes 0's to port 3f,
    then 04 to port 3e,
    then 5F to port 3d.

    Then it calls a subroutine at 6c that you didn't include. You'll have to dig through the data sheet to see what ports 3f, 3e and 3d are.

    If you don't know my whole story, keep your mouth shut.

    If you know my whole story, you're an accomplice. Keep your mouth shut. 

    Top
    dkinzer
    dkinzer's picture
    Level: Posting Freak
    Joined: Fri. Mar 12, 2004
    Posts: 1299 View posts
    Location: Portland, OR, USA
    Posted by dkinzer: Thu. Mar 22, 2012 - 02:34 PM
    • 1
    • 2
    • 3
    • 4
    • 5
    Total votes: 0

    Torby wrote:
    You'll have to dig through the data sheet to see what ports 3f, 3e and 3d are.
    Those ports have the same function on every AVR - SREG, SPH, SPL. Of course, ther ports vary by device or by group of devices.

    Don Kinzer
    ZBasic Microcontrollers
    http://www.zbasic.net

    Top
    unebonnevie
    unebonnevie's picture
    Level: Resident
    Joined: Thu. Oct 30, 2008
    Posts: 752 View posts
    Posted by unebonnevie: Thu. Mar 22, 2012 - 03:42 PM
    • 1
    • 2
    • 3
    • 4
    • 5
    Total votes: 0

    DO1THL wrote:
    Search for ReAVR from Johannes Assenbaum. It will create named labels, konstants, mark jumps and branches, whatever. I've used it several times and it worked perfectly for me.

    Thanks! And the link is https://www.avrfreaks.net/index.p...

    Top
    Torby
    Torby's picture
    Level: 10k+ Postman
    Joined: Tue. Nov 11, 2003
    Posts: 10444 View posts
    Location: Bartlesville Oklahoma USA
    Posted by Torby: Thu. Mar 22, 2012 - 04:34 PM
    • 1
    • 2
    • 3
    • 4
    • 5
    Total votes: 0

    dkinzer wrote:
    Torby wrote:
    You'll have to dig through the data sheet to see what ports 3f, 3e and 3d are.
    Those ports have the same function on every AVR - SREG, SPH, SPL. Of course, ther ports vary by device or by group of devices.

    hehe I haven't compared near enough datasheets to know that.

    If you don't know my whole story, keep your mouth shut.

    If you know my whole story, you're an accomplice. Keep your mouth shut. 

    Top
    dkinzer
    dkinzer's picture
    Level: Posting Freak
    Joined: Fri. Mar 12, 2004
    Posts: 1299 View posts
    Location: Portland, OR, USA
    Posted by dkinzer: Thu. Mar 22, 2012 - 06:01 PM
    • 1
    • 2
    • 3
    • 4
    • 5
    Total votes: 0

    Torby wrote:
    I haven't compared near enough datasheets to know that.
    On further thought, my statement was a bit too broad. On devices with 256 bytes or less of RAM, there is no SPH register. But on those devices that have one, it is located at 0x3e.

    Don Kinzer
    ZBasic Microcontrollers
    http://www.zbasic.net

    Top
    Topic locked