ROM analysis using disassembler with FEBuilderGBA (for hacker)

FEBuilderGBA is a tool to easily modify GBAFE,
It can also help those who want to analyze the code seriously.

This time, we will introduce the disassembler and the map file which are the basis of the analysis.

FEBuilderGBA has its own disassembler routine and map file generation routine.
With this you can get the asm source code with comments automatically inserted.

Please select Menu Tool → Disassembler from the menu.



Such source code is generated.

08E4F6E0 B500   push {, lr}
08E4F6E2 46C0   mov r8, r8
08E4F6E4 4B05   ldr r3, [pc, #0x14] # pointer:08E4F6FC -> 0202BCF4 (Gold )
08E4F6E6 6819   ldr r1, [r3, #0x0] # pointer:0202BCF4 (Gold )
08E4F6E8 2000   mov r0, #0x0
08E4F6EA 46C0   mov r8, r8
08E4F6EC 4A04   ldr r2, [pc, #0x10] # pointer:08E4F700
08E4F6EE 4291   cmp r1 ,r2
08E4F6F0 DB00   blt #0x8e4f6f4
    08E4F6F2 2001   mov r0, #0x1
08E4F6F4 4A03   ldr r2, [pc, #0xc] # pointer:08E4F704 -> 030004B0 (DATA Numbers clogged with event instruction 40050000XXXXXXXX )
08E4F6F6 6310   str r0, [r2, #0x30] # pointer:030004E0
08E4F6F8 2000   mov r0, #0x0
08E4F6FA BD00   pop {, lr}
08E4F6FC BCF4 0202   //LDRDATA
08E4F700 C350 0000   //LDRDATA
08E4F704 04B0 0300   //LDRDATA

From the menu, select Tools → Disassembler.

In the disassembler, if you enter the address of the function you want to see, its contents will be displayed.
However, I do not know where the function is.

Let's get all the source code here.
Please select “Save all to file”.

Select “Assemble all and save”.

You can choose whether to output the ASM source code or create a mapfile to importable for IDA.
In the latest version, We can also create a sym file for no$gba debugger.

Press the button and enter the file name you want to save.
Asm is output to the specified file endlessly.

Unlike disarm, FEBuilderGBA has the following functions.

- We can trace all LDR destination pointers.
- Names are automatically assigned to functions and memories whose functions are currently known using asmmap.
- We will briefly describe other data parts such as images.
- All numbers are output as # 0x1234 in hexadecimal notation.

However, the following restrictions apply.
- It only supports thumb mode.

All information known to FEBuilderGBA is output to the mapfile.

- Structure information that can be changed. romfe*.cs
- Information held by rom to disamble.
- Information on the address provided by the patch file.
- Information on lz77 compressed data existing in ROM.
- Simple display with multiple consecutive 0x00 and 0xFF as empty areas.
- Information on known functions and data areas. /config/data/asmmap*.txt

However, there is not enough information yet.
Please tell me if you know information about unknown functions.
In addition, because structures such as structures known by FEBuilderGBA and patches are also used as mapfile of disassembler,
The more you post a patch etc, the worse the disassembler automatically smarter.

Read the following article for ASM syntax:
https://feuniverse.us/t/gbafe-assembly-for-dummies-by-dummies/3563