4

Among many modern disassembly/reverse engineering tools, has any been used to disassemble legacy code for a word-oriented mainframe, preferably with a non-power-of-2 word length, like CDC 6600 (60 bit) or PDP-10 (36 bit)? If so, is there an existing open source example of a plugin implementing such an architecture?

(While some may infer a request for opinion from the above, please keep in mind that the phrasing of the question makes it a question of fact.)

Improve this question
16
  • "Modern disassembly tools" is a bit vague, do you mean more than simple disassembly? simh has (very simple) in-built disassembly of all supported architectures, including those with a non-power-of-2 word. And non-power-of-2 words are not a problem, as you'd extract the binary in question and provide it as a file on a modern computer, using some power-of-2 word big enough to embed the non-power-of-2 word. Radare2 has in open issue to implement a PDP-10 plugin.
    – dirkt
    Dec 10, 2020 at 7:20
  • Fixed-length instructions seem to be particularly easy to disassemble, the only issue being to decide whether some words are code or data, but then again to some extent it "doesn't matter" if you accidentally decode data as code; the human can usually see what happened.
    – another-dave
    Dec 10, 2020 at 13:10
  • @dirkt I mean also some analysis of the control flow, assigning labels to instructions to which a branch/jump can be made. The trick here is that addressing is done per word rather than per byte, and not every instruction can be addressed (there could be several instructions per word). Thank you for the link; I guess it is not that straightforward if the issue is pending since 2018.
    – Leo B.
    Dec 10, 2020 at 18:51
  • @another-dave For reverse engineering, telling code and data apart is substantial. You don't want to spend time decoding garbage instructions or providing manual guidance to the disassembler for every literal.
    – Leo B.
    Dec 10, 2020 at 18:53
  • I dunno - in my limited experience (mainly PDP-11 stuff) you just look at the dump and say "that ain't actually code" since it makes no sense. Side-by-side code, octal, and ASCII helps. Possibly this only works with sufficiently rich architectures, Maybe I couldn't do it with MIPS r2000 code output by a compiler.
    – another-dave
    Dec 10, 2020 at 19:34

1 Answer 1

Reset to default
5

Disclaimer: I work for Hex-Rays.

The IDA Pro by Hex-Rays supports disassembly of several processor families with “wide instruction words”, for example:

  1. PDP-11 (16-bit instructions)
  2. PIC (12-, 14- and 16-bit instruction sizes)
  3. Various DSPs from AD, TI and Motorola (generally 16 to 48 bits)
  4. Itanium (VLIW, 128-bit instruction bundles)

(There are probably more that escape my mind at the moment.)

It was also used to handle an esoteric ISA called cLEMENCy specifically invented for a CTF (capture the flag) contest, with a 9-bit byte size and middle-endian byte order:

https://github.com/cseagle/ida_clemency

In short, if IDA does not handle it, you can probably write a module to do it.

Improve this answer
5
  • 1
    Around 600,000 PDP-11s of all models were sold, making it one of DEC's most successful product lines. The PDP-11 is considered by some experts to be the most popular minicomputer. [Wikipedia] Is there a relatively big demand for the PDP-11 dissassembler, even today, because of this?
    – Single Malt
    Dec 11, 2020 at 10:57
  • @SingleMalt I don’t know how many people actually make use of PDP-11 support but there are probably some. It’s just one architecture of many supported by IDA.
    – Igor Skochinsky
    Dec 11, 2020 at 11:01
  • Thanks, understood. Does IDA work with Transmeta VLIW core binaries, or is this too esoteric?
    – Single Malt
    Dec 11, 2020 at 11:18
  • 1
    @SingleMalt there’s no standard support and I haven’t seen any third party code but I imagine it’s not impossible to add.
    – Igor Skochinsky
    Dec 11, 2020 at 11:19
  • I believe I would be able to; I just want to compare the amount of work required to add a processor to various available tools. The example is quite instructive; as "bytes" of up to 32 bit are supported, for a 48-bit architecture with 24-bit instructions declaring the byte size to be 24 should work.
    – Leo B.
    Dec 11, 2020 at 21:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .