Sun Jul 20 18:26:17 EDT 2014

M68ktrap

Earlier today I started trying to work on reverse engineering the rank for Batrider, so first thing I did was cobble the code ROMs together and setup the 68000 interrupt vectors, as usual. Unfortunately, I forgot that 68000 has A-line and F-line traps, and Yagawa uses them at length throughout the code for Garegga, Batrider, and Bakraid. These are software interrupts triggered whenever an instruction has the top 4 bits set to binary 1010 (A-line) or 1111 (F-line), and allow encoding 12 bits of trap code data so that you can use these interrupts for system calls.

These interrupts are actually extremely useful and cool, but IDA Pro's support for them is very underwhelming. A-line traps are supported, but to change what each code maps to, you need to modify a configuration file and re-load the CPU module, which is a huge hassle. F-line traps are completely unsupported, so you're left completely in the dark for those. They will ruin your time as well, since the 68000 module completely does not understand F-line traps, and treats them as unknown data. This is a particularly big problem since IDA Pro will refuse to build functions around unknown data.

As a solution, I wrote an IDAPython script/plugin that adds support for these software interrupts. This took me far longer than it should have, as there are very few examples of processor extensions for IDA in general, and there are practically none written in IDAPython. I figured the extension would be small enough that I shouldn't bother with writing it in C++ and figuring out that mess, so I was pretty determined to get it working in IDAPython. The lack of any good documentation on IDAPython's API is certainly no help here. So I'm releasing this module in the hopes that it helps somebody out if they attempt to write any of their own.

M68ktrap can be downloaded from https://bitbucket.org/trap15/m68ktrap-ida


Posted by trap15 | Permanent link | File under: reverse_engineering