[comp.sys.amiga.tech] Reverse-Engineering Device Drivers, II

djh@dragon.metaphor.com (Dallas J. Hodgson) (06/02/90)

A few days ago I posted my frustration at getting a perfectly re-assembled
device driver to work correctly. Well, I finally DID make it work, but let
me tell you the pitfalls so it doesn't happen to anyone else! My goal was
to make a binary as close to the original as possible.

Step #1: I lovingly reverse-crafted the device driver in question using
         Resource 4.0. During the course of this, I discovered that
	 Resource doesn't flag the presence of "hidden" opcode information,
	 such as "ANDI.B #$C0,D0" where the original opcode is actually
	 represented as #$FFC0. The 68K is supposed to ignore the FF, as
	 it's dealing with a .B command anyway. The reassembled output
	 would end up being #$00C0, which is more correct.

	 Resource wouldn't flag the difference between long absolute (32-bit)
	 jumps and 16-bit absolute jumps. This caused problems when the
	 assembler would reassemble something like "JMP 0" as a 16-bit
	 absolute rather than the longer (original) 32-bit jump.

Step #2: I'd verify my work every step of the way by comparing the code and
	 data segments of the executable (after stripping all loader info)
	 against the original. Once this test passed, I'd compare the
	 relocation & hunk information against each other as well. I
	 divided my source into segments that would match the original hunk
	 format as closely as possible. (Use dumpobj & dumpdiff for this)

Step #3: The final "voodoo" involved was that I had renamed my re-created
         device driver to a different name so both could coexist in my
	 mountlist. THIS WAS A MISTAKE! I haven't seen this written
	 anywhere, but I it's true - the filename of the driver must match
	 its internal name - or else!

Bravo to Markus Wandel for his outstanding "Devices" tutorial that appeared
recently on the net. I wish I had this when I needed it!
+----------------------------------------------------------------------------+
| Dallas J. Hodgson               |     "This here's the wattle,             |
| Metaphor Computer Systems       |      It's the emblem of our land.        |
| Mountain View, Ca.              |      You can put it in a bottle,         |
| USENET : djh@metaphor.com       |      You can hold it in your hand."      |
+============================================================================+
| "The views I express are my own, and not necessarily those of my employer" |
+----------------------------------------------------------------------------+