Radare is an open source portable reversing framework that can do many things, among those things it can disassemble 6502 code.

Download and install radare

  • First, download radare from github. You need a recent version in order to disassemble 6502 code.
  • And then install it by running sys/install.sh (or sys/user.sh for local installation):
$$$gcid/tsrycasld/oainrnees 2thatltlp.ss:h//github.com/radare/radare2.git

Loading a c64 .prg

Radare has many command line options. But in order to load 6502 programs we need just two:

  • -a6502 to specify the 6502 architecture.
  • -mMemoryAddress to map the file to a certain memory address. Use 2047 for “normal” programs. Usually they start at $0801 (2049), but we have to subtract 2 from the .prg header.

Example:

$r2-a6502-m2047mygame.prg

Disassembling

Radare doesn’t have a GUI, like IDA. Instead is has a powerful command line interface (think of GDB). Example:

$[0rx200-0a060570f2f]->m2047musicplayer.prg

And 0x7ff (2047) is the seek address, meaning that all commands will use that address as the base address. Let’s print the first 32 bytes. ( px = print hexa):

[o000fxxxf000s780ef00tff00700f01df0d]18c>0ap2b2x01382323a490005509b6e93d7243180a399693fA1002B000cC080dD007fE87acFde0123.495.6.728096A1B.C.D.ExF.

The “2061” that we see, is part of the BASIC “SYS 2061” command that usually appears in all C64 programs. So, let’s disassemble the first 12 instructions from 2061. ( pd = print disassemble):

[0x00000┌││└7┌││─│││└f───f><<]>000000000000xxxxxxxxxxxxp000000000000d00000000000000000000000010000000000002000000000000888888888888@001111111222de1358bce14520617aaab9cdcccd8d209980eea0010dff11ed204077aed1200ca088sllllsibdddbeddddtnneeeniaxyaayeccxe0##000000x00xxxxxxdxx12f00ec10a0788e020df11d407a,,yy

In case we don’t know the meaning of a certain opcode, we can print its description with ?d:

[s0ext00i0n0t0e8r1r5u]p>t?ddissaebilestatus

Or if we want to print the description in every disassembled line, we can do:

easm.describe=true

And then disassemble again:

[┌││└0──x><000000000000000xxxxxxxxxxxx0000000000000088888888888880011111112220de1358bce145e]>7aaab9cdcccd8d209980eea0p010dff11edd204077aed12001ca0882@20sllllsibdddb6eddddtnneeen1iaxyaayeccxe0##000000x00xxxxxxdxx12f00ec10a0788e020df11d407a,,yy;;;;;;;;;;;;sllllsibdddbeooootnreeertaaaaocacccaddddrrnrrrnieeceeecnaiiamhmmmhtcnncaeeeeecddccnonnnorueeuctntttnrmxxmuuuumirmmirplxyluneeenetaaldsmmdstwwtaeuooeudoiiotxlrrxlirttrotyytshhryxawwnbbnbimmiiboyybolteetnytytehmmhoooomoznnozsmrrmeneeeneteyyemererammoootoorurrysyy

For more disassembling options just type p?

Searching

In order to search for something, like in Vi, we have to use the / command. Examples:

Search for asm opcodes: /c opcode. The following will search for sta $d020, sta $d021, sta $d022, etc…

[000xxx0000000000000008882209ce]>##/c33::stssattaa0x00dxx0dd2002201

Search for strings (although this is not very useful since most probably the strings are stored in screen codes and not in PETSCII):

[0x0000080e]>/hello

Search for a sequence of hexadecimal bytes: /x. The following searches for the MSB of the music frequency table:

[S#h00eixxa7t00rs00c[:00h000ix100n898g080dbe6-]0h>bxiy1t/t30xed_s400.]1.00.11001100110011001202

We can use the flag hit0_0 to refer to that address. For example, in order to dump the  first 32 bytes from hit0_0 we can do:

[o000fxxxf000s998e890tccd]>00014p00x114300221400@314h00i425t000525_00062500726008260092700A2700B3700C3800D3800E3900F390123456789ABCDEF

For more search options just type /?

Visual Mode

Besides the Command Line Interface, Radare has another interface called the Visual Mode. It is similar to Vi, where each key has an associated function. In this mode, instead of entering commands, you just press one or two keys without pressing Enter.

In fact, some keys have the same Vi functionality:

  • hjkl: move around
  • gG: go top/bottom of page
  • : : Enter a command

Visual mode has 8 different view modes that can be activated by pressing p

  • hex, the hexadecimal view
  • disasm, the disassembly listing
  • debug, the debugger
  • words, the word-hexidecimal view
  • buf, the C-formatted buffer
  • annotated, the annotated op analysis color map
  • annotated, the annotated hexdump

Adding Comments

While analyzing code, sometimes it is useful to add comments. While in Visual Mode, we can add comments by pressing  ; plus the comment.

Example:

Saving

After adding some comments, we should save the project in order not to loose the changes. To save a project just enter Ps projectName (Project save), and to open an existing project enter Po projectName (Project open). And enter Pl to list existing projects. Example:

[m[m[R0y0y0expxpxl0r0r0o0o0o0a0j0j0d0e0e0i0c0c0n8t8t8g000dddp]]]r>>>ojPPPesloctmmyypprroojjeecctt

And from the command line, we can open existing projects with the -p argument. Example:

$r2-pmyproject

Getting help

Just append ? to each command to get more help about that command. Example:

  • ?  :to list all the possible commands
  • P?  :to get help about the Project (P) command
  • p? :to get help about the Print (p) command
  • p8?  :to get help about the Print 8bit hexpair command
  • and so on.

When in Visual Mode, also press ? to get help.

Other resources