rslr/amiga-bootcamp
1
0
Fork 0
mirror of https://github.com/alfishe/amiga-bootcamp.git synced 2026-10-27 09:16:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
amiga-bootcamp/05_reversing
History
Duncan Bowring ebb2dbeef7
Fix wrong LVO offsets in the exec and dos tables 
exec.library: Forbid, Permit, Disable and Enable were in the wrong
slots. Forbid/Permit move to -132/-138 and Disable/Enable to -120/-126.

dos.library: the table left out six private vectors but kept counting
as though they were not there, so every row after a missing one was
shifted, ending 36 bytes out. Restores ClearVec (-162), NoReqLoadSeg
(-168), Cli (-492), DosNameFromAnchor (-852), PathPart (-876) and
CliInit (-924) and realigns the rest.

Also fixes copies of the same wrong exec values, plus several wrong dos
offsets, in api_call_identification.md and setfunction_patching.md.

Checked against ADCD 2.1 References/Function.offs. V39 names in the
exec table (CreatePool, CachePreDMA, AddMemHandler and so on) are left
as they were, since they are more current than ADCD 2.0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-20 10:29:12 -04:00
..
case_studies More interesting hot stuff! 2026-04-29 23:18:55 -04:00
dynamic Fix wrong LVO offsets in the exec and dos tables 2026-09-20 10:29:12 -04:00
games Added mouse article 2026-06-15 13:30:24 -04:00
scripts More information. Especially about RE and AREXX automation 2026-04-29 21:42:28 -04:00
static Fix wrong LVO offsets in the exec and dos tables 2026-09-20 10:29:12 -04:00
anti_debugging.md More interesting hot stuff! 2026-04-29 23:18:55 -04:00
compiler_fingerprints.md More information. Especially about RE and AREXX automation 2026-04-29 21:42:28 -04:00
custom_loaders_and_drm.md docs: expand final 3 Tier 3 articles + update all README indexes 2026-05-12 23:02:22 -04:00
ghidra_setup.md More interesting hot stuff! 2026-04-29 23:18:55 -04:00
ida_setup.md More interesting hot stuff! 2026-04-29 23:18:55 -04:00
methodology.md More information. Especially about RE and AREXX automation 2026-04-29 21:42:28 -04:00
patching_techniques.md docs(amiga): complete AmigaOS 3.1/3.2 developer reference — 172 files across 17 sections 2026-04-23 12:17:35 -04:00
README.md docs: expand final 3 Tier 3 articles + update all README indexes 2026-05-12 23:02:22 -04:00
unpacking_and_decrunching.md More information. Especially about RE and AREXX automation 2026-04-29 21:42:28 -04:00

README.md

← Home

Reverse Engineering AmigaOS Binaries

Overview

This section provides a systematic methodology for reverse engineering AmigaOS executables and shared libraries using IDA Pro (or Ghidra with the Amiga plugin), with focus on:

  • Reconstructing the library JMP table
  • Identifying compiler-specific code patterns
  • Understanding the exec/dos calling convention at the assembly level
  • Tracing library patches (SetFunction)
  • Case studies from real Amiga software

Contents

File Topic
methodology.md Step-by-step RE workflow for Amiga HUNK binaries
ida_setup.md IDA Pro configuration for 68k/Amiga analysis
ghidra_setup.md Ghidra configuration for 68k/Amiga analysis & decompilation
compiler_fingerprints.md Compiler identification by code patterns
static/library_jmp_table.md Reconstructing unknown library JMP tables and LVOs
static/code_vs_data_disambiguation.md Distinguishing code bytes from data — IDA/Ghidra workflows
patching_techniques.md Surgical binary patching methods
unpacking_and_decrunching.md Executable unpacking, decruncher architecture, and manual extraction
custom_loaders_and_drm.md Custom bootblocks, trackloader architecture (raw MFM/Paula DMA), 6 DRM systems (Copylock, Psygnosis, EA, Gremlin), bootblock checksum, 5 antipatterns, trackloader identification cookbook, cracking scene history, modern analogies, 7 FAQ
anti_debugging.md The Cracker vs. Developer arms race: Trace vector abuse, NMI defeat, CIA timers
games/whdload_architecture.md WHDLoad internals, slaves, resload_DiskLoad, and runtime memory patching
case_studies/ Real-world RE walkthroughs
case_studies/ramdrive_device.md ramdrive.device RE walkthrough

Game Reverse Engineering

File Topic
games/game_reversing.md Game RE: disassembly, modification, asset extraction, save game analysis

Per-Compiler Reverse Engineering — Binary Field Manuals

File Topic
static/compilers/README.md Compiler identification flowchart and comparison matrix
static/compilers/sasc.md SAS/C 5.x/6.x — LINK A5 + 9-reg save, absolute strings, _LibBase globals
static/compilers/gcc.md GCC 2.95.x — .text hunk, A6 frame pointer, PC-relative strings, __CTOR_LIST__
static/compilers/vbcc.md VBCC — No frame pointer, per-function saves, __reg(), __MERGED hunks
static/compilers/stormc.md StormC / StormC++ — SAS/C-compatible C, unique C++ ABI, PPC support
static/compilers/aztec_c.md Manx Aztec C — D3-D7 save only (5 regs), D2 scratch, pre-1990 era
static/compilers/lattice_c.md Lattice C 3.x/4.x — SAS/C predecessor, simpler optimizer, 6-reg save
static/compilers/dice_c.md DICE C — No frame pointer, _mainCRTStartup, fast compile speed

Language-Specific Reverse Engineering

File Topic
static/asm68k_binaries.md Hand-written assembly reverse engineering — demos, games, bootblocks
static/ansi_c_reversing.md ANSI C reverse engineering — struct recovery, control flow, library anchoring
static/cpp_vtables_reversing.md C++ OOP reverse engineering — vtables, inheritance, RTTI, name mangling
static/other_languages.md Non-C languages — AMOS, Blitz Basic, Amiga E, Modula-2, FORTH, ARexx

Core Principles

  1. Know the ABI first — All library calls are JSR LVO(A6). Before reversing any function, identify which library A6 holds using the lib_Node.ln_Name string at base+$00.
  2. Use .fd files — The NDK39 .fd files give you every function name and parameter mapping for free.
  3. Relocations are your friend — HUNK_RELOC32 entries tell you exactly which longwords are inter-hunk references, making it easy to distinguish code from data.
  4. Compiler signatures reduce work — SAS/C vs GCC produces distinct prologues. Identifying the compiler narrows the pattern space dramatically.

Tool Setup

Tool Purpose
IDA Pro 7.x Primary static disassembler (no native M68k decompilation)
IDA Amiga plugin HUNK loader, HUNK_SYMBOL import
Ghidra + ghidra-amiga Powerful disassembler and C-pseudocode decompiler for M68k
hunkinfo Quick hunk/symbol/reloc dump
wack / MonAm On-device debugger

References

  • NDK39: fd/, include/
  • ADCD 2.1: complete library autodocs
  • Amiga ROM Kernel Reference Manual: Libraries and Devices