Radare is an open source portable reversing framework that can do many things, among those things it can disassemble 6502 code.
Download and install radare First, download radare from github. You need a recent version in order to disassemble 6502 code. And then install it by running sys/install.sh (or sys/user.sh for local installation): $ $ $ g c i d / t s r y c a s l d / o a i n r n e e s 2 t h a t l t l p . s s : h / / g i t h u b . c o m / r a d a r e / r a d a r e 2 . g i t Loading a c64 .prg Radare has many command line options. But in order to load 6502 programs we need just two:
-a6502 to specify the 6502 architecture. -mMemoryAddress to map the file to a certain memory address. Use 2047 for “normal” programs. Usually they start at $0801 (2049), but we have to subtract 2 from the .prg header. Example:
$ r 2 - a 6 5 0 2 - m 2 0 4 7 m y g a m e . p r g Disassembling Radare doesn’t have a GUI, like IDA. Instead is has a powerful command line interface (think of GDB). Example:
$ [ 0 r x 2 0 0 - 0 a 0 6 0 5 7 0 f 2 f ] - > m 2 0 4 7 m u s i c p l a y e r . p r g And 0x7ff (2047) is the seek address, meaning that all commands will use that address as the base address. Let’s print the first 32 bytes. ( px = print hexa):
[ o 0 0 0 f x x x f 0 0 0 s 7 8 0 e f 0 0 t f f 0 0 7 0 0 f 0 1 d f 0 d ] 1 8 c > 0 a p 2 b 2 x 0 1 3 8 2 3 2 3 a 4 9 0 0 0 5 5 0 9 b 6 e 9 3 d 7 2 4 3 1 8 0 a 3 9 9 6 9 3 f A 1 0 0 2 B 0 0 0 c C 0 8 0 d D 0 0 7 f E 8 7 a c F d e 0 1 2 3 . 4 9 5 . 6 . 7 2 8 0 9 6 A 1 B . C . D . E x F . The “2061” that we see, is part of the BASIC “SYS 2061” command that usually appears in all C64 programs. So, let’s disassemble the first 12 instructions from 2061. ( pd = print disassemble):
[ 0 x 0 0 0 0 0 ┌ │ │ └ 7 ┌ │ │ ─ │ │ │ └ f ─ ─ ─ f > < < ] > 0 0 0 0 0 0 0 0 0 0 0 0 x x x x x x x x x x x x p 0 0 0 0 0 0 0 0 0 0 0 0 d 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 8 8 8 8 8 8 8 8 8 8 8 8 @ 0 0 1 1 1 1 1 1 1 2 2 2 d e 1 3 5 8 b c e 1 4 5 2 0 6 1 7 a a a b 9 c d c c c d 8 d 2 0 9 9 8 0 e e a 0 0 1 0 d f f 1 1 e d 2 0 4 0 7 7 a e d 1 2 0 0 c a 0 8 8 s l l l l s i b d d d b e d d d d t n n e e e n i a x y a a y e c c x e 0 # # 0 0 0 0 0 0 x 0 0 x x x x x x d x x 1 2 f 0 0 e c 1 0 a 0 7 8 8 e 0 2 0 d f 1 1 d 4 0 7 a , , y y In case we don’t know the meaning of a certain opcode, we can print its description with ?d:
[ s 0 e x t 0 0 i 0 n 0 t 0 e 8 r 1 r 5 u ] p > t ? d d i s s a e b i l e s t a t u s Or if we want to print the description in every disassembled line, we can do:
e a s m . d e s c r i b e = t r u e And then disassemble again:
[ ┌ │ │ └ 0 ─ ─ x > < 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x x x x x x x x x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 8 8 8 8 8 8 8 8 8 8 8 8 8 0 0 1 1 1 1 1 1 1 2 2 2 0 d e 1 3 5 8 b c e 1 4 5 e ] > 7 a a a b 9 c d c c c d 8 d 2 0 9 9 8 0 e e a 0 p 0 1 0 d f f 1 1 e d d 2 0 4 0 7 7 a e d 1 2 0 0 1 c a 0 8 8 2 @ 2 0 s l l l l s i b d d d b 6 e d d d d t n n e e e n 1 i a x y a a y e c c x e 0 # # 0 0 0 0 0 0 x 0 0 x x x x x x d x x 1 2 f 0 0 e c 1 0 a 0 7 8 8 e 0 2 0 d f 1 1 d 4 0 7 a , , y y ; ; ; ; ; ; ; ; ; ; ; ; s l l l l s i b d d d b e o o o o t n r e e e r t a a a a o c a c c c a d d d d r r n r r r n i e e c e e e c n a i i a m h m m m h t c n n c a e e e e e c d d c c n o n n n o r u e e u c t n t t t n r m x x m u u u u m i r m m i r p l x y l u n e e e n e t a a l d s m m d s t w w t a e u o o e u d o i i o t x l r r x l i r t t r o t y y t s h h r y x a w w n b b n b i m m i i b o y y b o l t e e t n y t y t e h m m h o o o o m o z n n o z s m r r m e n e e e n e t e y y e m e r e r a m m o o o t o o r u r r y s y y For more disassembling options just type p?