Examples of Amiga Kickstart files (ROMs) can be 256k (1.2/1.3) or 512k (3.0/3.1) binary files, located at $FC0000-$1000000
or $F80000-$1000000
Several programs are able to "soft-kick" Amigas, i.e. install another ROM than the original one, without changing the chips physically, either to upgrade to a newer ROM to run more recent programs, or on the contrary to boot older programs that aren't compatible with new ROMs.
Since the ROM is by definition not writable, those soft-kick programs have to load the replacement Kickstart somewhere else in memory.
Problem is: the ROM files isn't position-independent code. It contains a lot of hardcoded addresses between $F80000/$FC0000
and $1000000
That's where the relocation table files (aka .RTB) come into play. A table exists for almost every official ROM file (see here).
My question is: how exactly are created those relocation table files ?
I tried to re-create those myself and failed. Actually I was able to find most of the reloc offsets, but still miss some.
For instance, this one is obvious, LAB_0186
must be relocated (it also could have been made originally PC-relative but that's another story:
LAB_0181:
LEA LAB_0186,A0 ;0fc208c: 41f900fc20c0
CLR.W D1 ;0fc2092: 4241
...
RTS ;0fc20be: 4e75
LAB_0186:
now that one is more subtle:
MOVE.L #$00fc1d28,312(A6) ;0fc034a: 2d7c00fc1d280138
One recognizes an address inside the ROM, but it could be a value too. Introducing heuristics to try to find the hidden ones can find some, but also find fake ones.
And there are tables, that are difficult to figure out for the same reason (plus disassembling data confuses the disassembler which thinks that some data are instructions):
DC.W $00fc ;0fc32c8
DC.W $25ae ;0fc32ca ; $FC25AE is probably an address
DC.W $00fc ;0fc32cc
LAB_029C:
MOVE.W (A6),(A1)+ ;0fc32ce: 32d6 ; $FC32D6 too
MOVE.W D0,D7 ;0fc32d0: 3e00 ; now there's this stray word
DC.W $00fc ;0fc32d2
MOVE.L (A6)+,252(A2) ;0fc32d4: 255e ; and another probable address again... argh!!! 00fc
MOVE.W -(A0),(A1)+ ;0fc32d8: 32e0
MOVE.W D0,D6 ;0fc32da: 3c00
DC.W $00fc ;0fc32dc
I doubt that those tables have been created by the actual Amiga developers who took time to assemble ROMs at different addresses to compute the relocation offsets (the simplest way to do that when you have the full source code) so someone did the hard job for all those Kickstarts
The author of skick probably created them himself and he confirms that it's non-trivial and is bragging about the fact that he's not going to disclose how it's done:
.RTB file consists of two parts. The first part contains all the relocation offsets ... It is created with a special program called RTG (relocation table generator) from specially pre-processed Kickstart image. How to get this image, it is my magic and I'll never tell anybody about it. One note only: generation of 39.046 .RTB took 1 1/2 hours. (Manual work, + about 10 mins my 7MHz '010 CPU time).
I'm impressed that the first part can be generated, on a 68010...
Second part contains BCPL relocation table and it is required for 1.3 ROM only. It was created manually, analysing dos.library, which is written in BCPL in 1.3.
That's more classical way to do it: fully reverse-engineer the program. I suppose it's easier because dos library is smaller, and doesn't change much between 1.x kickstarts. Not much mystery here.
.RTB file is not easy to create. I don't recommend anybody to try it without very good knowledge of assembly language and machine code (not the same). N.B. Auxiliary tools to do such work took 1 month to develop.
Yeah, I don't recommend it either...
Anyone has information on the RTG program or how it could work ? (the author didn't even have access to memory protection to execute and find ill-relocated locations...)