16 Apr
2018
16 Apr
'18
12:01 p.m.
Hi friends. I have a 1990's vintage commercial radio system that uses an 80C85A CPU. I
am looking to hopefully modify the firmware to make some small changes in its behavior.
The firmware is contained in two EPROMS.
Can anyone recommend a decent disassembler to use with this? Preferably something that ran
in windows 10 or windows 7? A dos box would be fine too.
Also, I looked through the dumped contents of the EPROM. In the past I have seen EPROM
ascii dumps where most is unintelligible to the naked eye but typically text messages give
to the users during interaction with the program are human readable. In this case, the
ASCII dump shows only other HEX data. I believe I read that there is a HEX format and
that I might need to convert from HEX to BIN before disassembling. Of course, an ideal
tool would do both if anyone knows such a thing.
I am not familiar with 8085 stuff but any insight would be appreciated.
Lastly, I wonder if there might be some kind of checksum check to prevent tampering. Is
there a common way this is handled in 8085 world? Or is it entirely programmer dependent?
Thanks for your time
Eugene W2HX?
16 Apr
16 Apr
1:48 p.m.
IDA Pro will do 8080/8085 and is very nice -- especially if you have no
source and are having to reverse-engineer the whole thing yourself. The
commercial version is expensive, but there's a free version. I don't
remember if the free version includes 8080/8085 mode.
The strings may be packed ASCII, to save space. There were a few methods of
doing this.
If there's a checksum it's not inherent to the CPU. There would need to be
custom hardware on the board to enforce a hardware ROM checksum; otherwise,
it's left to software and you can easily update that :)
Thanks,
Jonathan
On Mon, Apr 16, 2018 at 3:01 PM, W2HX via cctalk <cctalk at classiccmp.org>
wrote:
Hi friends. I have a 1990's vintage commercial
radio system that uses an
80C85A CPU. I am looking to hopefully modify the firmware to make some
small changes in its behavior. The firmware is contained in two EPROMS.
Can anyone recommend a decent disassembler to use with this? Preferably
something that ran in windows 10 or windows 7? A dos box would be fine too.
Also, I looked through the dumped contents of the EPROM. In the past I
have seen EPROM ascii dumps where most is unintelligible to the naked eye
but typically text messages give to the users during interaction with the
program are human readable. In this case, the ASCII dump shows only other
HEX data. I believe I read that there is a HEX format and that I might
need to convert from HEX to BIN before disassembling. Of course, an ideal
tool would do both if anyone knows such a thing.
I am not familiar with 8085 stuff but any insight would be appreciated.
Lastly, I wonder if there might be some kind of checksum check to prevent
tampering. Is there a common way this is handled in 8085 world? Or is it
entirely programmer dependent?
Thanks for your time
Eugene W2HX?
4:07 p.m.
On 04/16/2018 03:01 PM, W2HX via cctech wrote:
Hi friends. I have a 1990's vintage commercial
radio system that uses an 80C85A CPU. I am looking to hopefully modify the firmware to
make some small changes in its behavior. The firmware is contained in two EPROMS.
Can anyone recommend a decent disassembler to use with this? Preferably something that
ran in windows 10 or windows 7? A dos box would be fine too.
I've used DASMx
freeware.?
My primary for that work is resource/Zsource but that runs on my CP/M
box where my EPROM reader/writer is.
Google 8085 disassembler.? Try several to see what works for you.?
Generally those that interact with the
user are best as you can sorta guide them around text sections and allow
you to assign descriptive labels to
sections (subroutines).
You may even need a 8085 simulator to test sections of code.
Also, I looked through the dumped contents of the
EPROM. In the past I have seen EPROM ascii dumps where most is unintelligible to the naked
eye but typically text messages give to the users during interaction with the program are
human readable. In this case, the ASCII dump shows only other HEX data. I believe I read
that there is a HEX format and that I might need to convert from HEX to BIN before
disassembling. Of course, an ideal tool would do both if anyone knows such a thing.
You may depending on what the tool expects.? Usually hex dumps obscure
the text.? Its not common for
8085 programmers to compress text.?? That assumes the text is not a
bitmap for a LCD or LED then all
bets are off as to what you may see.
I am not familiar with 8085 stuff but any insight
would be appreciated.
I am. ? You will need to understand the 8085, its environment (the stuff
it controls) and
what the memory layout(both rom and ram)? and IO layout.? Learn the 8085
instruction set.
FYI the 8080/8085 user manual is on line so find it and get it will be a
big help.
As they say, you will be working very close to the raw metal.
One worry is that the code could have been written in C or PL/M (or PLI)
and that may obscure the code further.
Lastly, I wonder if there might be some kind of
checksum check to prevent tampering. Is there a common way this is handled in 8085 world?
Or is it entirely programmer dependent?
The 8085 does not have hardware checksum.? Its a programmer thing as in
who wrote the code and if there were
requirements by management or client to have checks (may include other
self tests and manufacturing
diagnostics as well).? However, its possible to do that in the code as
part of the startup self check (or BITE if mil).?
That only means you have to either negate that code (after finding it)
or you can find where the checksum is
and write a new one.?? In cases where I've seen it it was early in the
startup and was there to verify
the Eproms were not broken than a worry about tampering.
Doing this is not trivial and you are in full forensic sleuth mode.
Hope that helps.
Allison/KB1GMX
5:35 p.m.
You could post the EPROM files you have online somewhere for other
people to take a quick look. Maybe create a thread on the vcfed forum
and add them as an attachment to a message there. If you zip them up
they should be small enough for an attachment.
I have only tried using IDA Pro a couple of times. I haven't learned
how to use it well enough to be what I have used for similar 8-bit CPU
disassembly tasks in the past. I have just written my own basic
functionality 8085 / Z80 / 8051 disassemblers when I have had the
need. Not too hard to make it smart enough to be able to specify known
entry points (for example reset and interrupt vectors) and have it do
reachable code traversal from there. Some things require manual
intervention and iterative refinement, for example any indirect jumps
through call tables, or calculated jumps. Using a professional tool
might be quicker, but you might learn a lot more along the way doing
things yourself.
6:29 p.m.
On 04/16/2018 05:35 PM, Glen Slick via cctalk wrote:
I have only tried using IDA Pro a couple of times. I
haven't learned
how to use it well enough to be what I have used for similar 8-bit CPU
disassembly tasks in the past. I have just written my own basic
functionality 8085 / Z80 / 8051 disassemblers when I have had the
need. Not too hard to make it smart enough to be able to specify known
entry points (for example reset and interrupt vectors) and have it do
reachable code traversal from there. Some things require manual
intervention and iterative refinement, for example any indirect jumps
through call tables, or calculated jumps. Using a professional tool
might be quicker, but you might learn a lot more along the way doing
things yourself.
I've used IDA Pro quite a bit and like it a lot. One of things that it
does is analyze program flow. You can assign your own labels and symbol
names; it can detect subroutine boundaries and you can change the
assembly syntax of constants.
Disassembly is never lots of fun, but IDA makes it easier. I think that
it's still possible to get the old "free" version on the web. The
"pay
to play" version covers a lot of processors (8- 16- 32- and 64-bit).
IDA does require a bit of learning the lay of the land, but once you et
started, things get easier faster.
--Chuck
6:35 p.m.
Hi Glen, Allison, Jonathan, Chuck, et. al.
Thanks everyone for the suggestions. I investigated the IDA Pro and unfortunately, the
freeware version does not support 8085 and their lowest tier version costs $700 (ouch),
but I will look into others like DASMx. In case anyone is interested in the project, this
is a transmitter system. There is one button called PWR when pressed it cycles through
different output power levels - 125W, 500W, 1KW and then back to 125W and so on. Problem
is, I have a 500W amp, not a 1KW amp. The manufacturer was kind enough to explain that
they never got around to updating the firmware in the remote control for the 500W system
and therefore it assumes 1KW is available. In my case when 1KW comes around the system
goes into "funk mode". All I am looking to do is to remove the 1KW option and
have it cycle from 125W, 500W and back to 125W. I am hoping this could be done with a JMP
in the right place or some NOOPs or something.
Appreciate the responses.
Eugene W2HX
-----Original Message-----
From: cctalk [mailto:cctalk-bounces at classiccmp.org] On Behalf Of Glen Slick via cctalk
Sent: Monday, April 16, 2018 8:35 PM
To: General Discussion: On-Topic and Off-Topic Posts
Subject: Re: 8085 Dissasembly?
You could post the EPROM files you have online somewhere for other people to take a quick
look. Maybe create a thread on the vcfed forum and add them as an attachment to a message
there. If you zip them up they should be small enough for an attachment.
I have only tried using IDA Pro a couple of times. I haven't learned how to use it
well enough to be what I have used for similar 8-bit CPU disassembly tasks in the past. I
have just written my own basic functionality 8085 / Z80 / 8051 disassemblers when I have
had the need. Not too hard to make it smart enough to be able to specify known entry
points (for example reset and interrupt vectors) and have it do reachable code traversal
from there. Some things require manual intervention and iterative refinement, for example
any indirect jumps through call tables, or calculated jumps. Using a professional tool
might be quicker, but you might learn a lot more along the way doing things yourself.
6:49 p.m.
On Mon, Apr 16, 2018 at 07:01:51PM +0000, W2HX via cctech wrote:
Hi friends. I have a 1990's vintage commercial
radio system that uses an
80C85A CPU. I am looking to hopefully modify the firmware to make some
small changes in its behavior. The firmware is contained in two EPROMS.
Can anyone recommend a decent disassembler to use with this? Preferably
something that ran in windows 10 or windows 7? A dos box would be fine
too.
I wrote one for DOS eons ago that does simple execution tracing and
supports the 8085:
http://www.dbit.com/pub/ibmpc/dasm/
It's not perfect but the price is right and it comes with source.
John Wilson (KC1P)
D Bit
18 Apr
18 Apr
2:50 a.m.
On Mon, Apr 16, 2018 at 9:01 PM, W2HX via cctech <cctech at classiccmp.org> wrote:
Hi friends. I have a 1990's vintage commercial
radio system that uses an 80C85A CPU. I am looking to hopefully modify the firmware to
make some small changes in its behavior. The firmware is contained in two EPROMS.
Can anyone recommend a decent disassembler to use with this? Preferably something that
ran in windows 10 or windows 7? A dos box would be fine too.
Since it has not been mentioned yet: NF6X's dismantler supports the
8085 (and a couple of other CPUs): https://github.com/NF6X/dismantler
It is written in Python, so it should run on any platform where Python
is available. From the description "semiautomatic code recognition"
and "allows binary files to be disassembled from the command line".
Note: I haven't used it yet, so I have no personal experience of
whether it is good or not.
HTH
--
Regards,
Torfinn Ingolfsen
2:55 a.m.
For the simulator part, perhaps GNUSim8085 can be used:
https://gnusim8085.github.io/
Again, I have no personal experience with it (yet).
HTH
--
Regards,
Torfinn Ingolfsen
7:17 p.m.
On Apr 18, 2018, at 2:50 AM, Torfinn Ingolfsen via
cctech <cctech at classiccmp.org> wrote:
Since it has not been mentioned yet: NF6X's dismantler supports the
8085 (and a couple of other CPUs): https://github.com/NF6X/dismantler
It is written in Python, so it should run on any platform where Python
is available. From the description "semiautomatic code recognition"
and "allows binary files to be disassembled from the command line".
My main motivation for writing dismantler was that I was intrigued by recursive-descent
disassemblers such as IDA (which I had seen in use in videos, blog posts and
presentations), but didn't want to pay for IDA at the time. I've recently
purchased IDA Starter, so I may not use my own disassembler any more for future reverse
engineering projects. Dismantler is a pale shadow of IDA, but it's still a big
improvement over the simple disassemblers I've used in previous reverse engineering
projects.
Some of the future reverse engineering projects I have on my to-do list involve the
CDP1802 processor, which IDA presently doesn't support. When I get to them I'll
have to decide whether to use dismantler vs. learning how to add CDP1802 support to IDA.
I'm leaning towards the latter, because IDA is so much fancier than dismantler is.
--
Mark J. Blair, NF6X <nf6x at nf6x.net>
http://www.nf6x.net/
2220
days inactive
2223
days old
10 comments
9 participants
participants (9)
-
allisonportable＠gmail.com -
cclist＠sydex.com -
glen.slick＠gmail.com -
nf6x＠nf6x.net -
spacewar＠gmail.com -
systems.glitch＠gmail.com -
tingox＠gmail.com -
w2hx＠w2hx.com -
wilson＠dbit.com