TweetFollow Us on Twitter

Code Re-construction
Volume Number:2
Issue Number:9
Column Tag:Nosy News

The Art of Code Re-construction

By Steve Jasik, Menlo Park, CA

In this special article by the famous industry guru Steve Jasek, author of MacNosy, we get the inside scoop on the inner workings of Nosy and how to use it to best advantage. Since Steve is famous for his brief documentation, these pearls of wisdom will be most valuable, but be warned; this is not for the faint hearted, as Steve's technical background in compiler design is clearly evident. -Ed.

Sniffing Around with MacNosy

As I sit here pecking away on my Mac, it is mid June. Nosy 2.099 has been finalized and 2.1 is in progress. Most of the features I discuss in this article are in 2.099, and the rest will appear in 2.1 which will ship in July.

For starters, I'd like to try and answer some rhetorical questions such as:

What is and why use Nosy, and what advantage does it offer over other methods of obtaining information about programs?

Hypertext for programmmers

Nosy is a fancy disassembler with extensive reference map (Hypertext for programmmers?) and symbol substitution facilities that verges on being a de-compiler. Nosy can be used to obtain information about any program or resource that consists of 68000 native code. It does not handle Pcode, Mcode, etc. It can be used to obtain accurate and informative listings of the ROM (64 or 128K), resources on the system file, etc. It knows about the special structure of DRVR's (desk accessories) and PDEF's. It can create '.asm' files that can be fed into the MDS assembler. Later on this year it will be modified so that its output will be compatable with the MPW (Macintosh Programmer's Workshop) assembler.

Because it subdivides the program up into procedures and data blocks, and creates reference maps for those symbols, one is able to analyze what the program is doing without having to execute it in many cases. When Nosy is used in conjunction with a ".map" file produced by a Linker or the debug symbols left in the code by most compilers one can use it as a "source" level cross reference map facility for one's own program. This can aid in tracking down bugs or making modifications to the program. [Note: TML, LightSpeed and Consulair support debug code in their compilation that aids Nosy. -Ed.]

You Didn't Read this Section in MacTutor!

In the same vein one can use Nosy to locate and analyze copy protection code. Modifications scheduled for V2.1 will let one disassemble CODE segments from programs that are running in another partition under Switcher. This will allow one to analyze copy protection code that has been encrypted in the disk file copy of the program. The fun thing about this mod is that no program that is Switcher friendly will be able to protect against this form of copy protection analysis as they have no real way of knowing that Nosy is looking at them, and one will not need to make a debugger initially active, so programs that check for the presence of one, and then blowup will be hoodwinked. Note that some programs check for the presence of a debugger by inspecting the interrupt vector address's ( 0 to $100) to ensure that they reference ROM and blowup if they don't.

Fig. 1 Call Graph

Given the proper order of things in starting up Switcher, Nosy and the program to be analyzed, Nosy will temporarly put any debugger to "sleep" so any other program cannot detect its presence. After one has patched the code in the program that disables the debugger, one can wake up the debugger, and use a combination of it and Nosy to locate and disable the copy protection code. I am temped to offer a prize to anyone who can devise a method that cannot be cracked by Nosy. [Ouch! -Ed.]

More Coming

While I am in the process of teaching Nosy how to locate the CODE segments of running programs, I thought it would also be nice if Nosy was fixed so that it could disassemble arbitrarly large programs in 512K.

My motives for adding this facility at this time are two. Firstly to allow the analysis of programs that would not fit into memory, and secondly I will be needing more space for tables in order to do global data flow analysis soon.

You can also use Nosy for code inspection of your own application. As Nosy grows in size, I use Nosy on itself to look at the code generated by Lisa Pascal to see what code it is generating for a given sequence of statements, and when the code looks like it can be trimmed by choosing another sequence I rewrite it by using the type-casting facility, etc.

Other reasons for using Nosy are to learn about 68000 code, and how Macintosh applications are structured. The Nosy disk contains a number of interesting examples, including a fast Shell sort which is extensively commented, and describes my assembly language coding techniques.

Fig. 2 Flow Graph for above example

Compilers and Data Flow Analysis

Nosy makes use of a variety of techniques that are similar to those used in compilers. For example, it has a variety of symbol tables, which use the address of the symbol instead of the name as the primary lookup key. It also uses control and data flow analysis to obtain information about the structure of the program, but first some terminology and review. Control flow analysis, which concerns itself with the flow of execution in a program, is familiar to many programmmers.

A Basic block consists of a sequence of contigious statements such that if any statement in the block is executed, all are. Basic blocks end prior to an active label or after a jump instruction which would be representated in a higher level language by an if, case or goto statment. In a flow graph basic blocks are the nodes (the circles) and the edges are the possible flow paths of execution. (See fig. 1 for a diagram of a Basic Block). The usual conventions are that flow is from top to bottom with backward branchs representated as curved lines. The ground symbol represents the return statement. In the example below we have a simple for loop with a side branch that the programmmer would have written as:

 for j := Low to upLim do 
 if a[j] <> 0 then B[j] := B[j] / a[j];
 Return

In the process of analyzing the code, compilers will invent labels for basic blocks that are the target of branch instructions, which is why I rewrote the code in the diagram in fig. 2.

The process of collecting the flow of control information is a fairly simple one. Analyzing it to find the loops in the program, etc is slightly more complicated, but straightforward. When one does this on an inter-procedural level the resulting graph is called the "program call graph." Building a complete call graph in the presence of procedures that accept parameters as arguments is somewhat more difficult. For compilers this is no real problem, as very few of them do inter-procedural optimization. For Nosy it represents a real problem, as initially it does not know what the arguments to user procedures are or their types. To date, my solution to the problem has been to let the user supply the information manually by the Review data and IsProc commands which are discussed in the next section.

Fig. 3 Review Data command in window mode

Before we can discuss how Nosy can complete the call graph automatically, I need to say a bit about data flow analysis, which is the process of collecting information about the way variables are used in a program. In order to do effective global optimization or de-compilation one has to collect both control and data flow information. The exact sequence of events is that the control flow information for a procedure and the data flow tables for the basic blocks in a procedure are built first. Then the control flow information is used to "solve" the data flow equations globally. The questions that an optimizing compiler will be able to answer with the data flow information are:

What variables are not defined in the loop? The resulting set of expressions that use the variables are candidates for code motion out of the loop, etc.

When does the value of a variable that is assigned to a register in a loop have to be placed in memory prior to exit (is Live on exit) from a loop or more generally a basic block? This is usually called the Live/Dead information.

The information that a compiler collects for each variable/array in a basic block is called the use/def info, and consists of three bits for each variable; used in the block, defined in the block and used before definitation. From this and the control flow information one can develop the Live/Dead information.

For most real languages, the problem of building the use/def tables is compounded by alaising of names due to the presence of array references, or pointer variables which may point to the same location in memory at run-time. Most of you are familiar with the problem, but without giving it a name. As a simple example of alaising, consider the following sequence where p is a pointer to an integer:

p := addr(i);    { p is equivalenced or alaised to i }
x := A[i];
p^ := 2;
 y := A[i];    {would it be valid to change this to y := x;  ?? }

Given the above code it would be imprudent for an optimizing compiler to replace the second reference to A[i] ] with x, for example, since the value of i has been changed directly in memory, and thus the programmer expects x and y will have different values!

Fig. 4 IsProc command

The primary effect of alaising is to inhibit code optimization. Compilers for languages such as C, with its weak typing of pointer variables have a difficult time in producing good code in the presence of stores to pointer based variables.

Now back to Nosy. Another form of data flow problem concerns itself with determining the type of a variable based on its usage. This is the problem that Nosy has to solve if it is to automatically recognize procedural parameters and propagate this information back to the calls so that all code blocks will be recognized as such. To do this Nosy must perform a symbolic simulation of the 68000 registers and stack as it disassembles the instructions to determine the usage of variables in a basic block, and that it keep enough control flow information around so it can propagate the type information out of the procedure and back to the caller. I started to work on this problem a few weeks ago and got sidetracked by the needs of my documentator to complete window mode so that we could document the visable parts of Nosy. With luck I'll get back to it in time to show it off at the August MacWorld show.

As a final note in this section, the topics discussed here are relatively old hat, [! -Ed.] and one can find a more complete discussion of optimization and flow analysis in chapter 10 of the "Red Dragon" book by Aho, Sethi & Ullman (Addison-Wesley). It's correct title is "Compilers, Principles, techniques and Tools". It is a standard text book for Comp Sci undergraduates. I recommend its purchase to anyone who is interested in understanding the structure of compilers.

Fig. 5 Case Jumps

Using Nosy to reformat Data

Nosy analyzes a program by walking the tree of procedures to build the program call graph. At present, the treewalk is a one pass algorithm which recognizes the procedure entry points by their references in JSR's. Procedures that are passed as parameters (a common practice in Mac programs) are not recognized as code unless there is an explicit reference to them in a JSR. This creates the situation that not all the code is exposed by Nosy. To get around this problem, I created the Review data command which lets one inspect the data blocks, and reformat them as one wishs.

Now I have converted the Review data command to window mode, one can see the context in which a data block is referenced and do a more inteligent job of redefining the format of the block, be it code or otherwise.

When the Review data command is selected, Nosy cleans up the desktop by closing all the active windows except for the "-Notes-" window which is a scratchpad for your and Nosy's use. It then puts up a modeless dialog window for keyboard entry at the top of the screen, a menu window below it, a "-Data Blk-" window which displays the data block to be modified, and a '-Uses=" window with a display of a reference to the data block, if any exists. In Review data mode, all keyboard input is directed to the command window.

The illustration in figure 3 [RevDAT 1] shows the label data410 passed to APPENDST which we might guess to be a string concatenate routine. With this information, it is easy to surmise that data410 is a Pascal string. If one wanted to find out what APPENDST did, all one has to do is double click on the name and ctl-D to bring up a display of it. The only reason for reformatting all the data blocks in a program is if one wanted to "Cut and Paste" the code in it into another application.

An alternative way of reformatting data blocks in window mode is to mark them as procedure entry points with the "Is Proc" command. Data blocks marked as "IsProc" will be treated as the entry point to a procedure on all subsequent treewalks. In some programs, such as the PTCH resource in the System file, which contains the patchs to the ROM, it is easier to mark the data labels with the IsProc command then it is via Review data. Figure 4 [Ptch IsProc] illustrates the use of this command.

One hi-lites a data label, and then selects the "Is Proc" command. As an aside, note that most of the System Globals that begin with a lowercase j contain a pointer to the address of a routine, so one may Isproc them with impunity.

Case Statment Analysis

Another reason that all the code may not be apparant to Nosy is because of case statements that it cannot understand. The Case Jumps display (Fig. 5 next page) lets you determine which jumps are causing Nosy problems. The "Link Jump to Table" command lets you specify information about the jump so that Nosy can process it correctly the next time a treewalk is done. In figure 6 [Lnk JMP2] we see that the offending case jump table consists entirely of negative entries so Nosy has declined to set the length of the table at 7, which can be done with the dialog box in the upper left hand corner of the display. The basic problem is that during the treewalk when Nosy inspects the jump instruction, it does not know the length of the data block. Because all the jump table entries are negative, it is not sure where the table ends. When a jump table has at least one positive entry, Nosy can use that entry to determine the length of the jump table based on the assumption that code for the cases immediately follow the jump table.

The table format of this case statement is JUMPP, which means that the the jump table is to be interpreted as program relocatable offsets to procedure labels. The JUMPC format defines a case or switch table to be a set of jumps to com_ labels (code which is branched to by a JMP, BRA or Bxx instruction). The normal format for a case table which consists of jumps to labels local to a procedure is JUMPL. It is sometimes useful to break up a big procedure with a case table into smaller procedures by changing the format of the case table from JUMPL to JUMPC.

Closing thoughts

In writing the above section I was temped to go back, reinspect my algorithms and see if I couldn't automatically recognize the case discussed in the first example. After all, it is easier to solve the problem once in the product as opposed to have to explain it many times to others. Unfortunately Nosy does need human help in recognizing some patterns, and those of us who use it should be familiar with techniques for reformatting data, etc. Some time ago a famous industrial engineer, Peter Denning told an audience of Twist Drill manufacturers that what their customers wanted was not drills, but holes. I remind myself that what you want is information without hassle, and to that end I will continue to improve Nosy so the de-compilation process runs more on automatic, and less on manual. [Please help support Steve's efforts in our behalf by both BUYING Nosy and spreading the WORD, not the DISK. -Ed.]

Fig. 6 Correcting Table Jumps

 
AAPL
$104.94
Apple Inc.
+1.95
MSFT
$45.41
Microsoft Corpora
+1.03
GOOG
$546.88
Google Inc.
+14.17

MacTech Search:
Community Search:

Software Updates via MacUpdate

Art Text 2.4.8 - Create high quality hea...
Art Text is an OS X application for creating high quality textual graphics, headings, logos, icons, Web site elements, and buttons. Thanks to multi-layer support, creating complex graphics is no... Read more
Live Interior 3D Pro 2.9.6 - Powerful an...
Live Interior 3D Pro is a powerful yet very intuitive interior designing application. View Video Tutorials It has every feature of Live Interior 3D Standard, plus some exclusive ones: Create multi... Read more
The Hit List 1.1.7 - Advanced reminder a...
The Hit List manages the daily chaos of your modern life. It's easy to learn - it's as easy as making lists. And it's powerful enough to let you plan, then forget, then act when the time is right.... Read more
jAlbum Pro 12.2.4 - Organize your digita...
jAlbum Pro has all the features you love in jAlbum, but comes with a commercial license. With jAlbum, you can create gorgeous custom photo galleries for the Web without writing a line of code!... Read more
jAlbum 12.2.4 - Create custom photo gall...
With jAlbum, you can create gorgeous custom photo galleries for the Web without writing a line of code! Beginner-friendly, with pro results Simply drag and drop photos into groups, choose a design... Read more
ExpanDrive 4.1.7 - Access remote files o...
ExpanDrive builds cloud storage in every application, acts just like a USB drive plugged into your Mac. With ExpanDrive, you can securely access any remote file server directly from the Finder or... Read more
OmniOutliner Pro 4.1.3 - Pro version of...
OmniOutliner Pro is a flexible program for creating, collecting, and organizing information. Give your creativity a kick start by using an application that's actually designed to help you think. It'... Read more
Evernote 5.6.2 - Create searchable notes...
Evernote allows you to easily capture information in any environment using whatever device or platform you find most convenient, and makes this information accessible and searchable at anytime, from... Read more
OmniOutliner 4.1.3 - Organize your ideas...
OmniOutliner is a flexible program for creating, collecting, and organizing information. Give your creativity a kick start by using an application that's actually designed to help you think. It's... Read more
BBEdit 11.0 - Powerful text and HTML edi...
BBEdit is the leading professional HTML and text editor for the Mac. Specifically crafted in response to the needs of Web authors and software developers, this award-winning product provides a... Read more

Latest Forum Discussions

See All

Puzzle to the Center of the Earth Review
Puzzle to the Center of the Earth Review By Campbell Bird on October 23rd, 2014 Our Rating: :: SPELUNKING PUZZLESUniversal App - Designed for iPhone and iPad Do some puzzles to make some platforms in this smart and fun free-to-play... | Read more »
Sleep Attack TD Review
Sleep Attack TD Review By Jennifer Allen on October 23rd, 2014 Our Rating: :: A TRUE TWISTUniversal App - Designed for iPhone and iPad Sleep Attack TD is a tower defense game with a difference – you can rotate the layout – and it’s... | Read more »
Earn Your Master Camper Badge in Camp Po...
Earn Your Master Camper Badge in Camp Pokemon Posted by Jessica Fisher on October 23rd, 2014 [ permalink ] Universal App - Designed for iPhone and iPad | Read more »
Garruk Gets His Revenge in a New Magic 2...
Garruk Gets His Revenge in a New Magic 2015 Expansion, Coming This November Posted by Jessica Fisher on October 23rd, 2014 [ permalink ] | Read more »
Sentinels of the Multiverse Review
Sentinels of the Multiverse Review By Rob Thomas on October 23rd, 2014 Our Rating: :: SENTINELS ASSEMBLEiPad Only App - Designed for the iPad Greater Than Games’ tabletop classic, Sentinels of the Multiverse swoops in to save the... | Read more »
Build Your Own Fantasy Football Dynasty...
Build Your Own Fantasy Football Dynasty with Draft Day Posted by Jessica Fisher on October 23rd, 2014 [ permalink ] Universal App - Designed for iPhone and iPad | Read more »
Cars: Fast as Lightning – Tips, Tricks,...
Hey there, Stickers: Want to know all about how impressed we were with Radiator Springs? Check out our Cars: Fast as Lightning review! Cars: Fast as Lightning is a cute and fun app that combines racing and town-building with the charisma and... | Read more »
Jam Messenger Review
Jam Messenger Review By Jennifer Allen on October 23rd, 2014 Our Rating: :: SIMPLE MESSAGINGiPhone App - Designed for the iPhone, compatible with the iPad Want a very quick way to send push-based messages? Jam Messenger is basic... | Read more »
Felllice (Games)
Felllice 1.0 Device: iOS Universal Category: Games Price: $.99, Version: 1.0 (iTunes) Description: EXCLUSIVE PRICE DROP! 50% OFF FOR A LIMITED TIME! EAT EAT EAT AND GROW ! | Read more »
The Arrow Game: by Grazie Media (Games)
The Arrow Game: by Grazie Media 1.0 Device: iOS Universal Category: Games Price: $.99, Version: 1.0 (iTunes) Description: Guide a flying arrow through skyscrapers and city streets to hit a distant target. Experience an endless... | Read more »

Price Scanner via MacPrices.net

Save up to $125 on Retina MacBook Pros
B&H Photo has the new 2014 13″ and 15″ Retina MacBook Pros on sale for up to $125 off MSRP. Shipping is free, and B&H charges NY sales tax only. They’ll also include free copies of Parallels... Read more
Apple refurbished Time Capsules available sta...
The Apple Store has certified refurbished Time Capsules available for up to $60 off MSRP. Apple’s one-year warranty is included with each Time Capsule, and shipping is free: - 2TB Time Capsule: $255... Read more
Textilus New Word, Notes and PDF Processor fo...
Textilus is new word-crunching, notes, and PDF processor designed exclusively for the iPad. I haven’t had time to thoroughly check it out yet, but it looks great and early reviews are positive.... Read more
WD My Passport Pro Bus-Powered Thunderbolt RA...
WD’s My Passport Pro RAID solution is powered by an integrated Thunderbolt cable for true portability and speeds as high as 233 MB/s. HighlightsOverviewSpecifications Transfer, Back Up And Edit In... Read more
Save with Best Buy’s College Student Deals
Take an additional $50 off all MacBooks and iMacs at Best Buy Online with their College Students Deals Savings, valid through November 1st. Anyone with a valid .EDU email address can take advantage... Read more
iPad Air 2 & iPad mini 3 Best Tablets Yet...
The new iPads turned out to be pretty much everything I’d been hoping for and more than I’d expected.”More” particularly in terms of a drinking-from-a-firehose choice of models and configurations,... Read more
Drafts 4 Reinvents iOS Productivity App
N Richland Hills, Texas based Agile Tortoise has announced the release of Drafts 4 for iPhone and iPad. Drafts is a quick capture note taking app with flexible output actions. Drafts 4 scales from... Read more
AT&T accepting preorders for new iPads fo...
AT&T Wireless is accepting preorders for the new iPad Air 2 and iPad mini 3, cellular models, for $100 off MSRP with a 2-year service agreement: - 16GB iPad Air 2 WiFi + Cellular: $529.99 - 64GB... Read more
Apple offering refurbished Mac Pros for up to...
The Apple Store is offering Apple Certified Refurbished 2013 Mac Pros for up to $600 off the cost of new models. An Apple one-year warranty is included with each Mac Pro, and shipping is free. The... Read more
Select MacBook Airs $100 off MSRP, free shipp...
B&H Photo has 2014 a couple of MacBook Airs on sale for $100 off MSRP. Shipping is free, and B&H charges NY sales tax only. They also include free copies of Parallels Desktop and LoJack for... Read more

Jobs Board

Senior Event Manager, *Apple* Retail Market...
…This senior level position is responsible for leading and imagining the Apple Retail Team's global event strategy. Delivering an overarching brand story; in-store, Read more
*Apple* Solutions Consultant (ASC) - Apple (...
**Job Summary** The ASC is an Apple employee who serves as an Apple brand ambassador and influencer in a Reseller's store. The ASC's role is to grow Apple Read more
Project Manager / Business Analyst, WW *Appl...
…a senior project manager / business analyst to work within our Worldwide Apple Fulfillment Operations and the Business Process Re-engineering team. This role will work Read more
*Apple* Retail - Multiple Positions (US) - A...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
Position Opening at *Apple* - Apple (United...
…customers purchase our products, you're the one who helps them get more out of their new Apple technology. Your day in the Apple Store is filled with a range of Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.