A-Traps in Ghidra

[cy384]

For those unfamiliar with them, a-traps are a clever(?) trick used by the classic mac OS: it uses illegal instructions as a system call interface. When an illegal instruction gets hit, a lookup table is examined to figure out what code to run. This enables lots of shenanigans since the lookup table can be patched/modified at runtime.

Anyway, if you try to examine a classic mac application in most disassemblers, they'll freak out because there are illegal instructions everywhere. I (and I suspect some others) wanted to use Ghidra, so I came up with a dumb little hack. Basically, I defined ~800 new kinds of 68000 NOP instructions, one for every a-trap I could find, and stuck them in the appropriate data file for Ghidra. This allows the disassembler to continue when it runs into them and display at least the name of the a-trap.


How to:
Copy the contents of this file into "68000.sinc" right below the line starting with ":nop"

Caveats:
* there are duplicate names for some a-traps, I picked whatever one I liked best
* this doesn't tell Ghidra anything about what they actually do or what the expected parameters are
* definitely a hack, I imagine there's a better way to do it

tagging @cheesestraws and @mdeverhart since they mentioned interest!

 

[mdeverhart]

@cy384 Outstanding, thank you!

 

[cheesestraws]

Thankyou!

 

[olePigeon]

Not to be confused with "a trap" used in Godzilla vs. Ghidra.

 

[Melkhior]

Would someone have some tutorial on how to disassemble Mac code resources using Ghidra? There's some acceleration drivers I'd like to examine, but I'm not 68k-fluent enough to make heads or tails from Resorcerer's disassembly. The snippet of regenerated C code posted by @cheesestraws in the VNC-on-AU/X thread seems a lot more readable to me.

 

[Crutch]

Not to be confused with "a trap" used in Godzilla vs. Ghidra.

I always enjoyed this classic meme about MacOS assembly. (That IS what it’s about … right??)

 

[cheesestraws]

Would someone have some tutorial on how to disassemble Mac code resources using Ghidra? There's some acceleration drivers I'd like to examine, but I'm not 68k-fluent enough to make heads or tails from Resorcerer's disassembly. The snippet of regenerated C code posted by @cheesestraws in the VNC-on-AU/X thread seems a lot more readable to me.

I have had some luck using https://github.com/Hopper262/classic-mac-utils to get the code resources out of the resource fork to start with, then loading them into Ghidra just as raw binaries. You'll need to set the header up manually, but after that it's usually OK IME? The big annoyance is that Ghidra doesn't support debugging symbols in the style that's usually used in code resources, so you need to go and manually rename everything (unless someone has a better trick for this)

 

[Melkhior]

@cheesestraws Thanks, that's the kind of tools I needed. Acceleration cdev / init usually 'hide' the code in custom resources with weird headers (for dispatch?), but worst-case scenario they can be renamed to 'code' and post-processed to get something usable.
Now to find the time for that and the other billions things I'd like to do...

 

[cheesestraws]

custom resources with weird headers

There's actually a standard for these headers that Apple recommended people writing code resources follow. So you may well get lucky and find these are all variations on a theme. I can't remember where the theme is documented, though.

 

[Scott Squires]

I have used this code for resolving A traps in Ghidra:

GitHub - ubuntor/m68k_mac_reversing_tools: Binary Ninja and Ghidra tools for reversing M68k Mac binaries

Binary Ninja and Ghidra tools for reversing M68k Mac binaries - GitHub - ubuntor/m68k_mac_reversing_tools: Binary Ninja and Ghidra tools for reversing M68k Mac binaries

github.com

 

[robin-fo]

Sorry for hijacking this thread, but does anybody have experience/tips about disassembling Extensions or other Code Resources?

 

[twelvetone12]

Upping this, I too would be interested on how to disassemble code resouces!

 

[Snial]

Upping this, I too would be interested on how to disassemble code resouces!

There used to be a plug-in for ResEdit 2.1.3 which did that.

 

[robin-fo]

disassembling

Sorry I meant decompiling

 

[twelvetone12]

Yes yes I mean the same, I can already explore the disassembled code with Resourcer.