Skip to content

Instantly share code, notes, and snippets.

@fuzyll
Created July 25, 2016 04:24
Show Gist options
  • Save fuzyll/29596bf2a5e5b5397d826c77ff534bf1 to your computer and use it in GitHub Desktop.
Save fuzyll/29596bf2a5e5b5397d826c77ff534bf1 to your computer and use it in GitHub Desktop.
Updated version of Binary Ninja's NES plugin (tries to handle more mappers).
# Copyright (c) 2015-2016 Vector 35 LLC
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to
# deal in the Software without restriction, including without limitation the
# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
# sell copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
# IN THE SOFTWARE.
# FIXME: no way to directly link two banks right now, so you can't double-click
# a function implemented in another bank and have it navigate there
# FIXME: no current way to prevent it from making "functions" in the current bank
# that should be in another bank
# FIXME: should be able to ask for cross-references to the MMC3 memory-mapped registers
# by using get_code_refs and giving it the register address
import traceback
import sys
import os
import platform
import struct
try:
from binaryninja import *
except ImportError:
if platform.mac_ver()[0]:
sys.path.append("/Applications/Binary Ninja.app/Contents/Resources/python")
from binaryninja import *
InstructionNames = [
"brk", "ora", None, None, None, "ora", "asl", None, # 0x00
"php", "ora", "asl@", None, None, "ora", "asl", None, # 0x08
"bpl", "ora", None, None, None, "ora", "asl", None, # 0x10
"clc", "ora", None, None, None, "ora", "asl", None, # 0x18
"jsr", "and", None, None, "bit", "and", "rol", None, # 0x20
"plp", "and", "rol@", None, "bit", "and", "rol", None, # 0x28
"bmi", "and", None, None, None, "and", "rol", None, # 0x30
"sec", "and", None, None, None, "and", "rol", None, # 0x38
"rti", "eor", None, None, None, "eor", "lsr", None, # 0x40
"pha", "eor", "lsr@", None, "jmp", "eor", "lsr", None, # 0x48
"bvc", "eor", None, None, None, "eor", "lsr", None, # 0x50
"cli", "eor", None, None, None, "eor", "lsr", None, # 0x58
"rts", "adc", None, None, None, "adc", "ror", None, # 0x60
"pla", "adc", "ror@", None, "jmp", "adc", "ror", None, # 0x68
"bvs", "adc", None, None, None, "adc", "ror", None, # 0x70
"sei", "adc", None, None, None, "adc", "ror", None, # 0x78
None, "sta", None, None, "sty", "sta", "stx", None, # 0x80
"dey", None, "txa", None, "sty", "sta", "stx", None, # 0x88
"bcc", "sta", None, None, "sty", "sta", "stx", None, # 0x90
"tya", "sta", "txs", None, None, "sta", None, None, # 0x98
"ldy", "lda", "ldx", None, "ldy", "lda", "ldx", None, # 0xa0
"tay", "lda", "tax", None, "ldy", "lda", "ldx", None, # 0xa8
"bcs", "lda", None, None, "ldy", "lda", "ldx", None, # 0xb0
"clv", "lda", "tsx", None, "ldy", "lda", "ldx", None, # 0xb8
"cpy", "cmp", None, None, "cpy", "cmp", "dec", None, # 0xc0
"iny", "cmp", "dex", None, "cpy", "cmp", "dec", None, # 0xc8
"bne", "cmp", None, None, None, "cmp", "dec", None, # 0xd0
"cld", "cmp", None, None, None, "cmp", "dec", None, # 0xd8
"cpx", "sbc", None, None, "cpx", "sbc", "inc", None, # 0xe0
"inx", "sbc", "nop", None, "cpx", "sbc", "inc", None, # 0xe8
"beq", "sbc", None, None, None, "sbc", "inc", None, # 0xf0
"sed", "sbc", None, None, None, "sbc", "inc", None # 0xf8
]
NONE = 0
ABS = 1
ABS_DEST = 2
ABS_X = 3
ABS_X_DEST = 4
ABS_Y = 5
ABS_Y_DEST = 6
ACCUM = 7
ADDR = 8
IMMED = 9
IND = 10
IND_X = 11
IND_X_DEST = 12
IND_Y = 13
IND_Y_DEST = 14
REL = 15
ZERO = 16
ZERO_DEST = 17
ZERO_X = 18
ZERO_X_DEST = 19
ZERO_Y = 20
ZERO_Y_DEST = 21
InstructionOperandTypes = [
NONE, IND_X, NONE, NONE, NONE, ZERO, ZERO_DEST, NONE, # 0x00
NONE, IMMED, ACCUM, NONE, NONE, ABS, ABS_DEST, NONE, # 0x08
REL, IND_Y, NONE, NONE, NONE, ZERO_X, ZERO_X_DEST, NONE, # 0x10
NONE, ABS_Y, NONE, NONE, NONE, ABS_X, ABS_X_DEST, NONE, # 0x18
ADDR, IND_X, NONE, NONE, ZERO, ZERO, ZERO_DEST, NONE, # 0x20
NONE, IMMED, ACCUM, NONE, ABS, ABS, ABS_DEST, NONE, # 0x28
REL, IND_Y, NONE, NONE, NONE, ZERO_X, ZERO_X_DEST, NONE, # 0x30
NONE, ABS_Y, NONE, NONE, NONE, ABS_X, ABS_X_DEST, NONE, # 0x38
NONE, IND_X, NONE, NONE, NONE, ZERO, ZERO_DEST, NONE, # 0x40
NONE, IMMED, ACCUM, NONE, ADDR, ABS, ABS_DEST, NONE, # 0x48
REL, IND_Y, NONE, NONE, NONE, ZERO_X, ZERO_X_DEST, NONE, # 0x50
NONE, ABS_Y, NONE, NONE, NONE, ABS_X, ABS_X_DEST, NONE, # 0x58
NONE, IND_X, NONE, NONE, NONE, ZERO, ZERO_DEST, NONE, # 0x60
NONE, IMMED, ACCUM, NONE, IND, ABS, ABS_DEST, NONE, # 0x68
REL, IND_Y, NONE, NONE, NONE, ZERO_X, ZERO_X_DEST, NONE, # 0x70
NONE, ABS_Y, NONE, NONE, NONE, ABS_X, ABS_X_DEST, NONE, # 0x78
NONE, IND_X_DEST, NONE, NONE, ZERO_DEST, ZERO_DEST, ZERO_DEST, NONE, # 0x80
NONE, NONE, NONE, NONE, ABS_DEST, ABS_DEST, ABS_DEST, NONE, # 0x88
REL, IND_Y_DEST, NONE, NONE, ZERO_X_DEST, ZERO_X_DEST, ZERO_Y_DEST, NONE, # 0x90
NONE, ABS_Y_DEST, NONE, NONE, NONE, ABS_X_DEST, NONE, NONE, # 0x98
IMMED, IND_X, IMMED, NONE, ZERO, ZERO, ZERO, NONE, # 0xa0
NONE, IMMED, NONE, NONE, ABS, ABS, ABS, NONE, # 0xa8
REL, IND_Y, NONE, NONE, ZERO_X, ZERO_X, ZERO_Y, NONE, # 0xb0
NONE, ABS_Y, NONE, NONE, ABS_X, ABS_X, ABS_Y, NONE, # 0xb8
IMMED, IND_X, NONE, NONE, ZERO, ZERO, ZERO_DEST, NONE, # 0xc0
NONE, IMMED, NONE, NONE, ABS, ABS, ABS_DEST, NONE, # 0xc8
REL, IND_Y, NONE, NONE, NONE, ZERO_X, ZERO_X_DEST, NONE, # 0xd0
NONE, ABS_Y, NONE, NONE, NONE, ABS_X, ABS_X_DEST, NONE, # 0xd8
IMMED, IND_X, NONE, NONE, ZERO, ZERO, ZERO_DEST, NONE, # 0xe0
NONE, IMMED, NONE, NONE, ABS, ABS, ABS_DEST, NONE, # 0xe8
REL, IND_Y, NONE, NONE, NONE, ZERO_X, ZERO_X_DEST, NONE, # 0xf0
NONE, ABS_Y, NONE, NONE, NONE, ABS_X, ABS_X_DEST, NONE # 0xf8
]
OperandLengths = [
0, # NONE
2, # ABS
2, # ABS_DEST
2, # ABS_X
2, # ABS_X_DEST
2, # ABS_Y
2, # ABS_Y_DEST
0, # ACCUM
2, # ADDR
1, # IMMED
2, # IND
1, # IND_X
1, # IND_X_DEST
1, # IND_Y
1, # IND_Y_DEST
1, # REL
1, # ZERO
1, # ZREO_DEST
1, # ZERO_X
1, # ZERO_X_DEST
1, # ZERO_Y
1 # ZERO_Y_DEST
]
OperandTokens = [
lambda value: [], # NONE
lambda value: [InstructionTextToken(PossibleAddressToken, "$%.4x" % value, value)], # ABS
lambda value: [InstructionTextToken(PossibleAddressToken, "$%.4x" % value, value)], # ABS_DEST
lambda value: [InstructionTextToken(PossibleAddressToken, "$%.4x" % value, value),
InstructionTextToken(TextToken, ", "), InstructionTextToken(RegisterToken, "x")], # ABS_X
lambda value: [InstructionTextToken(PossibleAddressToken, "$%.4x" % value, value),
InstructionTextToken(TextToken, ", "), InstructionTextToken(RegisterToken, "x")], # ABS_X_DEST
lambda value: [InstructionTextToken(PossibleAddressToken, "$%.4x" % value, value),
InstructionTextToken(TextToken, ", "), InstructionTextToken(RegisterToken, "y")], # ABS_Y
lambda value: [InstructionTextToken(PossibleAddressToken, "$%.4x" % value, value),
InstructionTextToken(TextToken, ", "), InstructionTextToken(RegisterToken, "y")], # ABS_Y_DEST
lambda value: [InstructionTextToken(RegisterToken, "a")], # ACCUM
lambda value: [InstructionTextToken(PossibleAddressToken, "$%.4x" % value, value)], # ADDR
lambda value: [InstructionTextToken(TextToken, "#"), InstructionTextToken(IntegerToken, "$%.2x" % value, value)], # IMMED
lambda value: [InstructionTextToken(TextToken, "["), InstructionTextToken(PossibleAddressToken, "$%.4x" % value, value),
InstructionTextToken(TextToken, "]")], # IND
lambda value: [InstructionTextToken(TextToken, "["), InstructionTextToken(PossibleAddressToken, "$%.2x" % value, value),
InstructionTextToken(TextToken, ", "), InstructionTextToken(RegisterToken, "x"),
InstructionTextToken(TextToken, "]")], # IND_X
lambda value: [InstructionTextToken(TextToken, "["), InstructionTextToken(PossibleAddressToken, "$%.2x" % value, value),
InstructionTextToken(TextToken, ", "), InstructionTextToken(RegisterToken, "x"),
InstructionTextToken(TextToken, "]")], # IND_X_DEST
lambda value: [InstructionTextToken(TextToken, "["), InstructionTextToken(PossibleAddressToken, "$%.2x" % value, value),
InstructionTextToken(TextToken, "], "), InstructionTextToken(RegisterToken, "y")], # IND_Y
lambda value: [InstructionTextToken(TextToken, "["), InstructionTextToken(PossibleAddressToken, "$%.2x" % value, value),
InstructionTextToken(TextToken, "], "), InstructionTextToken(RegisterToken, "y")], # IND_Y_DEST
lambda value: [InstructionTextToken(PossibleAddressToken, "$%.4x" % value, value)], # REL
lambda value: [InstructionTextToken(PossibleAddressToken, "$%.2x" % value, value)], # ZERO
lambda value: [InstructionTextToken(PossibleAddressToken, "$%.2x" % value, value)], # ZERO_DEST
lambda value: [InstructionTextToken(PossibleAddressToken, "$%.2x" % value, value),
InstructionTextToken(TextToken, ", "), InstructionTextToken(RegisterToken, "x")], # ZERO_X
lambda value: [InstructionTextToken(PossibleAddressToken, "$%.2x" % value, value),
InstructionTextToken(TextToken, ", "), InstructionTextToken(RegisterToken, "x")], # ZERO_X_DEST
lambda value: [InstructionTextToken(PossibleAddressToken, "$%.2x" % value, value),
InstructionTextToken(TextToken, ", "), InstructionTextToken(RegisterToken, "y")], # ZERO_Y
lambda value: [InstructionTextToken(PossibleAddressToken, "$%.2x" % value, value),
InstructionTextToken(TextToken, ", "), InstructionTextToken(RegisterToken, "y")] # ZERO_Y_DEST
]
def indirect_load(il, value):
if (value & 0xff) == 0xff:
lo_addr = il.const(2, value)
hi_addr = il.const(2, (value & 0xff00) | ((value + 1) & 0xff))
lo = il.zero_extend(2, il.load(1, lo_addr))
hi = il.shift_left(2, il.zero_extend(2, il.load(1, hi_addr)), il.const(2, 8))
return il.or_expr(2, lo, hi)
return il.load(2, il.const(2, value))
def load_zero_page_16(il, value):
if il[value].operation == "LLIL_CONST":
if il[value].value == 0xff:
lo = il.zero_extend(2, il.load(1, il.const(2, 0xff)))
hi = il.shift_left(2, il.zero_extend(2, il.load(1, il.const(2, 0)), il.const(2, 8)))
return il.or_expr(2, lo, hi)
return il.load(2, il.const(2, il[value].value))
il.append(il.set_reg(1, LLIL_TEMP(0), value))
value = il.reg(1, LLIL_TEMP(0))
lo_addr = value
hi_addr = il.add(1, value, il.const(1, 1))
lo = il.zero_extend(2, il.load(1, lo_addr))
hi = il.shift_left(2, il.zero_extend(2, il.load(1, hi_addr)), il.const(2, 8))
return il.or_expr(2, lo, hi)
OperandIL = [
lambda il, value: None, # NONE
lambda il, value: il.load(1, il.const(2, value)), # ABS
lambda il, value: il.const(2, value), # ABS_DEST
lambda il, value: il.load(1, il.add(2, il.const(2, value), il.zero_extend(2, il.reg(1, "x")))), # ABS_X
lambda il, value: il.add(2, il.const(2, value), il.zero_extend(2, il.reg(1, "x"))), # ABS_X_DEST
lambda il, value: il.load(1, il.add(2, il.const(2, value), il.zero_extend(2, il.reg(1, "y")))), # ABS_Y
lambda il, value: il.add(2, il.const(2, value), il.zero_extend(2, il.reg(1, "y"))), # ABS_Y_DEST
lambda il, value: il.reg(1, "a"), # ACCUM
lambda il, value: il.const(2, value), # ADDR
lambda il, value: il.const(1, value), # IMMED
lambda il, value: indirect_load(il, value), # IND
lambda il, value: il.load(1, load_zero_page_16(il, il.add(1, il.const(1, value), il.reg(1, "x")))), # IND_X
lambda il, value: load_zero_page_16(il, il.add(1, il.const(1, value), il.reg(1, "x"))), # IND_X_DEST
lambda il, value: il.load(1, il.add(2, load_zero_page_16(il, il.const(1, value)), il.reg(1, "y"))), # IND_Y
lambda il, value: il.add(2, load_zero_page_16(il, il.const(1, value)), il.reg(1, "y")), # IND_Y_DEST
lambda il, value: il.const(2, value), # REL
lambda il, value: il.load(1, il.const(2, value)), # ZERO
lambda il, value: il.const(2, value), # ZERO_DEST
lambda il, value: il.load(1, il.zero_extend(2, il.add(1, il.const(1, value), il.reg(1, "x")))), # ZERO_X
lambda il, value: il.zero_extend(2, il.add(1, il.const(1, value), il.reg(1, "x"))), # ZERO_X_DEST
lambda il, value: il.load(1, il.zero_extend(2, il.add(1, il.const(1, value), il.reg(1, "y")))), # ZERO_Y
lambda il, value: il.zero_extend(2, il.add(1, il.const(1, value), il.reg(1, "y"))) # ZERO_Y_DEST
]
def cond_branch(il, cond, dest):
t = None
if il[dest].operation == LLIL_CONST:
t = il.get_label_for_address(Architecture['6502'], il[dest].value)
if t is None:
t = LowLevelILLabel()
indirect = True
else:
indirect = False
f = LowLevelILLabel()
il.append(il.if_expr(cond, t, f))
if indirect:
il.mark_label(t)
il.append(il.jump(dest))
il.mark_label(f)
return None
def jump(il, dest):
label = None
if il[dest].operation == LLIL_CONST:
label = il.get_label_for_address(Architecture['6502'], il[dest].value)
if label is None:
il.append(il.jump(dest))
else:
il.append(il.goto(label))
return None
def get_p_value(il):
c = il.flag_bit(1, "c", 0)
z = il.flag_bit(1, "z", 1)
i = il.flag_bit(1, "i", 2)
d = il.flag_bit(1, "d", 3)
b = il.flag_bit(1, "b", 4)
v = il.flag_bit(1, "v", 6)
s = il.flag_bit(1, "s", 7)
return il.or_expr(1, il.or_expr(1, il.or_expr(1, il.or_expr(1, il.or_expr(1,
il.or_expr(1, c, z), i), d), b), v), s)
def set_p_value(il, value):
il.append(il.set_reg(1, LLIL_TEMP(0), value))
il.append(il.set_flag("c", il.test_bit(1, il.reg(1, LLIL_TEMP(0)), il.const(1, 0x01))))
il.append(il.set_flag("z", il.test_bit(1, il.reg(1, LLIL_TEMP(0)), il.const(1, 0x02))))
il.append(il.set_flag("i", il.test_bit(1, il.reg(1, LLIL_TEMP(0)), il.const(1, 0x04))))
il.append(il.set_flag("d", il.test_bit(1, il.reg(1, LLIL_TEMP(0)), il.const(1, 0x08))))
il.append(il.set_flag("b", il.test_bit(1, il.reg(1, LLIL_TEMP(0)), il.const(1, 0x10))))
il.append(il.set_flag("v", il.test_bit(1, il.reg(1, LLIL_TEMP(0)), il.const(1, 0x40))))
il.append(il.set_flag("s", il.test_bit(1, il.reg(1, LLIL_TEMP(0)), il.const(1, 0x80))))
return None
def rti(il):
set_p_value(il, il.pop(1))
return il.ret(il.pop(2))
InstructionIL = {
"adc": lambda il, operand: il.set_reg(1, "a", il.add_carry(1, il.reg(1, "a"), operand, flags = "*")),
"asl": lambda il, operand: il.store(1, operand, il.shift_left(1, il.load(1, operand), il.const(1, 1), flags = "czs")),
"asl@": lambda il, operand: il.set_reg(1, "a", il.shift_left(1, operand, il.const(1, 1), flags = "czs")),
"and": lambda il, operand: il.set_reg(1, "a", il.and_expr(1, il.reg(1, "a"), operand, flags = "zs")),
"bcc": lambda il, operand: cond_branch(il, il.flag_condition(LLFC_UGE), operand),
"bcs": lambda il, operand: cond_branch(il, il.flag_condition(LLFC_ULT), operand),
"beq": lambda il, operand: cond_branch(il, il.flag_condition(LLFC_E), operand),
"bit": lambda il, operand: il.and_expr(1, il.reg(1, "a"), operand, flags = "czs"),
"bmi": lambda il, operand: cond_branch(il, il.flag_condition(LLFC_NEG), operand),
"bne": lambda il, operand: cond_branch(il, il.flag_condition(LLFC_NE), operand),
"bpl": lambda il, operand: cond_branch(il, il.flag_condition(LLFC_POS), operand),
"brk": lambda il, operand: il.system_call(),
"bvc": lambda il, operand: cond_branch(il, il.not_expr(0, il.flag("v")), operand),
"bvs": lambda il, operand: cond_branch(il, il.flag("v"), operand),
"clc": lambda il, operand: il.set_flag("c", il.const(0, 0)),
"cld": lambda il, operand: il.set_flag("d", il.const(0, 0)),
"cli": lambda il, operand: il.set_flag("i", il.const(0, 0)),
"clv": lambda il, operand: il.set_flag("v", il.const(0, 0)),
"cmp": lambda il, operand: il.sub(1, il.reg(1, "a"), operand, flags = "czs"),
"cpx": lambda il, operand: il.sub(1, il.reg(1, "x"), operand, flags = "czs"),
"cpy": lambda il, operand: il.sub(1, il.reg(1, "y"), operand, flags = "czs"),
"dec": lambda il, operand: il.store(1, operand, il.sub(1, il.load(1, operand), il.const(1, 1), flags = "zs")),
"dex": lambda il, operand: il.set_reg(1, "x", il.sub(1, il.reg(1, "x"), il.const(1, 1), flags = "zs")),
"dey": lambda il, operand: il.set_reg(1, "y", il.sub(1, il.reg(1, "y"), il.const(1, 1), flags = "zs")),
"eor": lambda il, operand: il.set_reg(1, "a", il.xor_expr(1, il.reg(1, "a"), operand, flags = "zs")),
"inc": lambda il, operand: il.store(1, operand, il.add(1, il.load(1, operand), il.const(1, 1), flags = "zs")),
"inx": lambda il, operand: il.set_reg(1, "x", il.add(1, il.reg(1, "x"), il.const(1, 1), flags = "zs")),
"iny": lambda il, operand: il.set_reg(1, "y", il.add(1, il.reg(1, "y"), il.const(1, 1), flags = "zs")),
"jmp": lambda il, operand: jump(il, operand),
"jsr": lambda il, operand: il.call(operand),
"lda": lambda il, operand: il.set_reg(1, "a", operand, flags = "zs"),
"ldx": lambda il, operand: il.set_reg(1, "x", operand, flags = "zs"),
"ldy": lambda il, operand: il.set_reg(1, "y", operand, flags = "zs"),
"lsr": lambda il, operand: il.store(1, operand, il.logical_shift_right(1, il.load(1, operand), il.const(1, 1), flags = "czs")),
"lsr@": lambda il, operand: il.set_reg(1, "a", il.logical_shift_right(1, il.reg(1, "a"), il.const(1, 1), flags = "czs")),
"nop": lambda il, operand: il.nop(),
"ora": lambda il, operand: il.set_reg(1, "a", il.or_expr(1, il.reg(1, "a"), operand, flags = "zs")),
"pha": lambda il, operand: il.push(1, il.reg(1, "a")),
"php": lambda il, operand: il.push(1, get_p_value(il)),
"pla": lambda il, operand: il.set_reg(1, "a", il.pop(1), flags = "zs"),
"plp": lambda il, operand: set_p_value(il, il.pop(1)),
"rol": lambda il, operand: il.store(1, operand, il.rotate_left_carry(1, il.load(1, operand), il.const(1, 1), flags = "czs")),
"rol@": lambda il, operand: il.set_reg(1, "a", il.rotate_left_carry(1, il.reg(1, "a"), il.const(1, 1), flags = "czs")),
"ror": lambda il, operand: il.store(1, operand, il.rotate_right_carry(1, il.load(1, operand), il.const(1, 1), flags = "czs")),
"ror@": lambda il, operand: il.set_reg(1, "a", il.rotate_right_carry(1, il.reg(1, "a"), il.const(1, 1), flags = "czs")),
"rti": lambda il, operand: rti(il),
"rts": lambda il, operand: il.ret(il.add(2, il.pop(2), il.const(2, 1))),
"sbc": lambda il, operand: il.set_reg(1, "a", il.sub_borrow(1, il.reg(1, "a"), operand, flags = "*")),
"sec": lambda il, operand: il.set_flag("c", il.const(0, 1)),
"sed": lambda il, operand: il.set_flag("d", il.const(0, 1)),
"sei": lambda il, operand: il.set_flag("i", il.const(0, 1)),
"sta": lambda il, operand: il.store(1, operand, il.reg(1, "a")),
"stx": lambda il, operand: il.store(1, operand, il.reg(1, "x")),
"sty": lambda il, operand: il.store(1, operand, il.reg(1, "y")),
"tax": lambda il, operand: il.set_reg(1, "x", il.reg(1, "a"), flags = "zs"),
"tay": lambda il, operand: il.set_reg(1, "y", il.reg(1, "a"), flags = "zs"),
"tsx": lambda il, operand: il.set_reg(1, "x", il.reg(1, "s"), flags = "zs"),
"txa": lambda il, operand: il.set_reg(1, "a", il.reg(1, "x"), flags = "zs"),
"txs": lambda il, operand: il.set_reg(1, "s", il.reg(1, "x")),
"tya": lambda il, operand: il.set_reg(1, "a", il.reg(1, "y"), flags = "zs")
}
class M6502(Architecture):
name = "6502"
address_size = 2
default_int_size = 1
regs = {
"a": RegisterInfo("a", 1),
"x": RegisterInfo("x", 1),
"y": RegisterInfo("y", 1),
"s": RegisterInfo("s", 1)
}
stack_pointer = "s"
flags = ["c", "z", "i", "d", "b", "v", "s"]
flag_write_types = ["*", "czs", "zvs", "zs"]
flag_roles = {
"c": SpecialFlagRole, # Not a normal carry flag, subtract result is inverted
"z": ZeroFlagRole,
"v": OverflowFlagRole,
"s": NegativeSignFlagRole
}
flags_required_for_flag_condition = {
LLFC_UGE: ["c"],
LLFC_ULT: ["c"],
LLFC_E: ["z"],
LLFC_NE: ["z"],
LLFC_NEG: ["s"],
LLFC_POS: ["s"]
}
flags_written_by_flag_write_type = {
"*": ["c", "z", "v", "s"],
"czs": ["c", "z", "s"],
"zvs": ["z", "v", "s"],
"zs": ["z", "s"]
}
def decode_instruction(self, data, addr):
if len(data) < 1:
return None, None, None, None
opcode = ord(data[0])
instr = InstructionNames[opcode]
if instr is None:
return None, None, None, None
operand = InstructionOperandTypes[opcode]
length = 1 + OperandLengths[operand]
if len(data) < length:
return None, None, None, None
if OperandLengths[operand] == 0:
value = None
elif operand == REL:
value = (addr + 2 + struct.unpack("b", data[1])[0]) & 0xffff
elif OperandLengths[operand] == 1:
value = ord(data[1])
else:
value = struct.unpack("<H", data[1:3])[0]
return instr, operand, length, value
def perform_get_instruction_info(self, data, addr):
instr, operand, length, value = self.decode_instruction(data, addr)
if instr is None:
return None
result = InstructionInfo()
result.length = length
if instr == "jmp":
if operand == ADDR:
result.add_branch(UnconditionalBranch, struct.unpack("<H", data[1:3])[0])
else:
result.add_branch(UnresolvedBranch)
elif instr == "jsr":
result.add_branch(CallDestination, struct.unpack("<H", data[1:3])[0])
elif instr in ["rti", "rts"]:
result.add_branch(FunctionReturn)
if instr in ["bcc", "bcs", "beq", "bmi", "bne", "bpl", "bvc", "bvs"]:
dest = (addr + 2 + struct.unpack("b", data[1])[0]) & 0xffff
result.add_branch(TrueBranch, dest)
result.add_branch(FalseBranch, addr + 2)
return result
def perform_get_instruction_text(self, data, addr):
instr, operand, length, value = self.decode_instruction(data, addr)
if instr is None:
return None
tokens = []
tokens.append(InstructionTextToken(TextToken, "%-7s " % instr.replace("@", "")))
tokens += OperandTokens[operand](value)
return tokens, length
def perform_get_instruction_low_level_il(self, data, addr, il):
instr, operand, length, value = self.decode_instruction(data, addr)
if instr is None:
return None
operand = OperandIL[operand](il, value)
instr = InstructionIL[instr](il, operand)
if isinstance(instr, list):
for i in instr:
il.append(i)
elif instr is not None:
il.append(instr)
return length
def perform_is_never_branch_patch_available(self, data, addr):
if (data[0] == "\x10") or (data[0] == "\x30") or (data[0] == "\x50") or (data[0] == "\x70") or (data[0] == "\x90") or (data[0] == "\xb0") or (data[0] == "\xd0") or (data[0] == "\xf0"):
return True
return False
def perform_is_invert_branch_patch_available(self, data, addr):
if (data[0] == "\x10") or (data[0] == "\x30") or (data[0] == "\x50") or (data[0] == "\x70") or (data[0] == "\x90") or (data[0] == "\xb0") or (data[0] == "\xd0") or (data[0] == "\xf0"):
return True
return False
def perform_is_always_branch_patch_available(self, data, addr):
return False
def perform_is_skip_and_return_zero_patch_available(self, data, addr):
return (data[0] == "\x20") and (len(data) == 3)
def perform_is_skip_and_return_value_patch_available(self, data, addr):
return (data[0] == "\x20") and (len(data) == 3)
def perform_convert_to_nop(self, data, addr):
return "\xea" * len(data)
def perform_never_branch(self, data, addr):
if (data[0] == "\x10") or (data[0] == "\x30") or (data[0] == "\x50") or (data[0] == "\x70") or (data[0] == "\x90") or (data[0] == "\xb0") or (data[0] == "\xd0") or (data[0] == "\xf0"):
return "\xea" * len(data)
return None
def perform_invert_branch(self, data, addr):
if (data[0] == "\x10") or (data[0] == "\x30") or (data[0] == "\x50") or (data[0] == "\x70") or (data[0] == "\x90") or (data[0] == "\xb0") or (data[0] == "\xd0") or (data[0] == "\xf0"):
return chr(ord(data[0]) ^ 0x20) + data[1:]
return None
def perform_skip_and_return_value(self, data, addr, value):
if (data[0] != "\x20") or (len(data) != 3):
return None
return "\xa9" + chr(value & 0xff) + "\xea"
class NESViewUpdateNotification(BinaryDataNotification):
def __init__(self, view):
self.view = view
def data_written(self, view, offset, length):
addr = offset - self.view.rom_offset
while length > 0:
bank_ofs = addr & 0x3fff
if (bank_ofs + length) > 0x4000:
to_read = 0x4000 - bank_ofs
else:
to_read = length
if length < to_read:
to_read = length
if (addr >= (bank_ofs + (self.view.__class__.bank * 0x4000))) and (addr < (bank_ofs + ((self.view.__class__.bank + 1) * 0x4000))):
self.view.notify_data_written(0x8000 + bank_ofs, to_read)
elif (addr >= (bank_ofs + (self.view.rom_length - 0x4000))) and (addr < (bank_ofs + self.view.rom_length)):
self.view.notify_data_written(0xc000 + bank_ofs, to_read)
length -= to_read
addr += to_read
def data_inserted(self, view, offset, length):
self.view.notify_data_written(0x8000, 0x8000)
def data_removed(self, view, offset, length):
self.view.notify_data_written(0x8000, 0x8000)
class NESView(BinaryView):
name = "NES"
long_name = "NES ROM"
def __init__(self, data):
BinaryView.__init__(self, data.file)
self.data = data
self.notification = NESViewUpdateNotification(self)
self.data.register_notification(self.notification)
@classmethod
def is_valid_for_data(self, data):
# ensure enough data exists for a header and that the magic is valid
hdr = data.read(0, 16)
if len(hdr) < 16:
return False
if hdr[0:4] != "NES\x1a":
return False
# get the iNES mapper version for this ROM
mapper = struct.unpack("B", hdr[7])[0] | (struct.unpack("B", hdr[6])[0] >> 4)
# ensure that our ROM bank isn't out-of-range
rom_banks = struct.unpack("B", hdr[4])[0]
if mapper == 4:
rom_banks *= 2 # ROM banks are half-size on the MMC3
if rom_banks < (self.bank + 1):
return False
return True
def init(self):
try:
# unpack the ROM header
# FIXME: iNES 1.0 flags NYI, iNES 2.0 fields NYI
# FIXME: trainer NYI
hdr = self.data.read(0, 16)
self.rom_banks = struct.unpack("B", hdr[4])[0]
self.vrom_banks = struct.unpack("B", hdr[5])[0]
self.rom_flags = struct.unpack("B", hdr[6])[0]
self.mapper = struct.unpack("B", hdr[7])[0] | (self.rom_flags >> 4)
self.ram_banks = struct.unpack("B", hdr[8])[0]
self.rom_start = 16
if self.rom_flags & 4: # skip the optional trainer if it exists
self.rom_start += 512
self.mmc3_bank_mode = 0 # default to $C000 bank being fixed
if self.mapper == 4:
# ROM banks are half-size on the MMC3
self.rom_bank_size = 0x2000
self.rom_banks *= 2
else:
self.rom_bank_size = 0x4000
self.rom_end = self.rom_banks * self.rom_bank_size
# define the 3 CPU hardware vectors and set their functions
nmi = struct.unpack("<H", self.read(0xfffa, 2))[0]
start = struct.unpack("<H", self.read(0xfffc, 2))[0]
irq = struct.unpack("<H", self.read(0xfffe, 2))[0]
self.define_auto_symbol(Symbol(FunctionSymbol, nmi, "_nmi"))
self.define_auto_symbol(Symbol(FunctionSymbol, start, "_start"))
self.define_auto_symbol(Symbol(FunctionSymbol, irq, "_irq"))
self.add_function(Architecture['6502'].standalone_platform, nmi)
self.add_function(Architecture['6502'].standalone_platform, irq)
self.add_entry_point(Architecture['6502'].standalone_platform, start)
# FIXME: horrible heuristic for trying to detect which MMC3 bank mode is used for a given ROM
# appears to work properly for SMB2 and SMB3, but possibly not Mega Man III?
if self.mapper == 4:
start_code = self.read(start, 0x10000 - start)
if "\xa9\x40\x8d\x00\x80" in start_code:
log_warn("MMC3 bank mode switched to 1")
# if lda #$40 -> sta $8000, we need to change the MMC3 bank mode
self.mmc3_bank_mode = 1
# define the PPU and APU hardware vectors
self.define_auto_symbol(Symbol(DataSymbol, 0x2000, "PPUCTRL"))
self.define_auto_symbol(Symbol(DataSymbol, 0x2001, "PPUMASK"))
self.define_auto_symbol(Symbol(DataSymbol, 0x2002, "PPUSTATUS"))
self.define_auto_symbol(Symbol(DataSymbol, 0x2003, "OAMADDR"))
self.define_auto_symbol(Symbol(DataSymbol, 0x2004, "OAMDATA"))
self.define_auto_symbol(Symbol(DataSymbol, 0x2005, "PPUSCROLL"))
self.define_auto_symbol(Symbol(DataSymbol, 0x2006, "PPUADDR"))
self.define_auto_symbol(Symbol(DataSymbol, 0x2007, "PPUDATA"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4000, "SQ1_VOL"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4001, "SQ1_SWEEP"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4002, "SQ1_LO"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4003, "SQ1_HI"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4004, "SQ2_VOL"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4005, "SQ2_SWEEP"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4006, "SQ2_LO"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4007, "SQ2_HI"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4008, "TRI_LINEAR"))
self.define_auto_symbol(Symbol(DataSymbol, 0x400a, "TRI_LO"))
self.define_auto_symbol(Symbol(DataSymbol, 0x400b, "TRI_HI"))
self.define_auto_symbol(Symbol(DataSymbol, 0x400c, "NOISE_VOL"))
self.define_auto_symbol(Symbol(DataSymbol, 0x400e, "NOISE_LO"))
self.define_auto_symbol(Symbol(DataSymbol, 0x400f, "NOISE_HI"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4010, "DMC_FREQ"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4011, "DMC_RAW"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4012, "DMC_START"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4013, "DMC_LEN"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4014, "OAMDMA"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4015, "SND_CHN"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4016, "JOY1"))
self.define_auto_symbol(Symbol(DataSymbol, 0x4017, "JOY2"))
# define the hardware vectors for extra chips
if self.mapper == 4:
self.define_auto_symbol(Symbol(DataSymbol, 0x8000, "MMC3_BANK_SEL"))
self.define_auto_symbol(Symbol(DataSymbol, 0x8001, "MMC3_BANK_DAT"))
# read and apply symbol files (if any exist)
sym_files = [self.data.file.filename + ".%x.nl" % self.__class__.bank,
self.data.file.filename + ".ram.nl",
self.data.file.filename + ".%x.nl" % (self.rom_banks - 1)]
for f in sym_files:
if os.path.exists(f):
sym_contents = open(f, "r").read()
lines = sym_contents.split('\n')
for line in lines:
sym = line.split('#')
if len(sym) < 3:
break
addr = int(sym[0][1:], 16)
name = sym[1]
self.define_auto_symbol(Symbol(FunctionSymbol, addr, name))
if addr >= 0x8000:
self.add_function(Architecture['6502'].standalone_platform, addr)
return True
except:
log_error(traceback.format_exc())
return False
def perform_is_valid_offset(self, addr):
# valid ROM addresses are the upper-half of the address space
if (addr >= 0x8000) and (addr < 0x10000):
return True
return False
def perform_read(self, addr, length):
# fail if address is out-of-bounds
if addr < 0x8000:
return None
if addr >= (0x8000 + self.rom_end):
return None
# truncate read length to stay in bounds
if (addr + length) > 0x10000:
length = 0x10000 - addr
# read all data from ROM
result = ""
while length > 0:
# calculate the offset and the amount we still need to read
bank_ofs = addr & (self.rom_bank_size - 1)
if (bank_ofs + length) > self.rom_bank_size:
to_read = self.rom_bank_size - bank_ofs
else:
to_read = length
# start reading
if self.mapper == 4:
if addr >= 0xe000:
# $E000-$FFFF is always fixed to the last bank in the ROM for this mapper
rom_ofs = self.rom_start + bank_ofs + (self.rom_end - self.rom_bank_size)
elif (addr >= 0xc000 and self.mmc3_bank_mode == 0) or (addr <= 0x9fff and self.mmc3_bank_mode == 1):
# $C000-$DFFF is fixed to the next-to-last bank in the ROM if the bank mode is 0
# $8000-$9FFF is fixed to the next-to-last bank in the ROM if the bank mode is 1
rom_ofs = self.rom_start + bank_ofs + (self.rom_end - (self.rom_bank_size * 2))
elif (addr >= 0xc000 and self.mmc3_bank_mode == 1) or (addr >= 0xa000 and self.mmc3_bank_mode == 0):
if self.__class__.bank >= self.rom_banks - 2:
# FIXME: assume the second ROM bank if we're one of the two fixed banks
rom_ofs = self.rom_start + bank_ofs + self.rom_bank_size
else:
# FIXME: assume the next ROM bank is always mapped here (don't actually know which will be)
rom_ofs = self.rom_start + bank_ofs + ((self.__class__.bank + 1) * self.rom_bank_size)
elif (addr >= 0xa000 and self.mmc3_bank_mode == 1) or (addr >= 0x8000 and self.mmc3_bank_mode == 0):
if self.__class__.bank >= (self.rom_banks - 2):
# FIXME: assume the first ROM bank if we're one of the two fixed banks
rom_ofs = self.rom_start + bank_ofs
else:
# FIXME: assume the current ROM bank is always mapped here (don't actually know which will be)
rom_ofs = self.rom_start + bank_ofs + (self.__class__.bank * self.rom_bank_size)
else:
# default handler for mappers: 0, 1, 2, 3
# FIXME: for mapper 1, this code doesn't properly handle bank switch modes 2 or 3 (switch upper bank)
if addr >= 0xc000:
rom_ofs = self.rom_start + bank_ofs + (self.rom_end - self.rom_bank_size)
else:
rom_ofs = self.rom_start + bank_ofs + (self.__class__.bank * self.rom_bank_size)
data = self.data.read(rom_ofs, to_read)
result += data
if len(data) < to_read:
break
length -= to_read
addr += to_read
return result
def perform_write(self, addr, value):
# FIXME: mapper 4 NYI - code below assumes mapper 0
# fail if address is out-of-bounds
if addr < 0x8000:
return 0
if addr >= (0x8000 + self.rom_end):
return 0
# truncate write length to stay in bounds
if (addr + len(value)) > (0x8000 + self.rom_end):
length = (0x8000 + self.rom_end) - addr
else:
length = len(value)
if (addr + length) > 0x10000:
length = 0x10000 - addr
# start writing
offset = 0
while length > 0:
bank_ofs = addr & 0x3fff
if (bank_ofs + length) > 0x4000:
to_write = 0x4000 - bank_ofs
else:
to_write = length
if addr < 0xc000:
written = self.data.write(self.rom_start + bank_ofs + (self.__class__.bank * self.rom_bank_size), value[offset : offset + to_write])
else:
written = self.data.write(self.rom_start + bank_ofs + self.rom_end - self.rom_bank_size, value[offset : offset + to_write])
if written < to_write:
break
length -= to_write
addr += to_write
offset += to_write
return offset
def perform_get_start(self):
return 0 # 0x0000 is always the lowest address in memory
def perform_get_length(self):
return 0x10000 # 0xFFFF is always the highest address in memory
def perform_is_executable(self):
return True
def perform_get_entry_point(self):
# 0xFFFC is the "reset vector" on the NES (CPU always starts here)
return struct.unpack("<H", str(self.perform_read(0xfffc, 2)))[0]
banks = []
for i in xrange(0, 32):
class NESViewBank(NESView):
bank = i
name = "NES Bank %X" % i
long_name = "NES ROM (bank %X)" % i
def __init__(self, data):
NESView.__init__(self, data)
banks.append(NESViewBank)
NESViewBank.register()
M6502.register()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment