TweetFollow Us on Twitter

Volume Number:1
Issue Number:6
Column Tag:MacNosy

A New Disassembler

By Steve Jasik

A New Disassembler

As a compiler writer specializing in code generation, I decided to build a Disassembler to better understand the Motorola 68000 and the Macintosh operating system. Given the poor quality of the documentation and the general lack of source listings, a powerful disassembler is a useful tool for debugging and getting information about the system.

MacNosy and its helper programs consist of over 7000 lines of Pascal and about 300 lines of assembly lanaguage code. Internally, MacNosy contains many features usually associated with a compiler such as a table manager, symbol table enter/lookup routines, a reference map, global flow analysis, etc.


MacNosy has many features that place it an order of magnitude above other disassemblers. They include:

• Symbol dictionaries of the Rom names and global symbols (0 - $B00) along with value to symbol substitution in appropriate places.

• Selective list of procedures in a file by procedure name or substring.

• Ability to place the disassembled output on a file in assembler listing output or assembler input format (MDS “.list” or “.asm” format).

• References to the symbols are collected and may be selectively viewed.

• Ability to search the program file for references to selected address’s, trap (rom) calls, resource type references, constant or string references.

• Ability to translate the segment relative address of an instruction to the disk file relative address for code patching purposes.

• MacNosy records its input on a “.jrnl” file (in text format) for later playback. This feature is used as an educational tool and as a medium of communication between developers, hackers, etc.

• Ability to reformat data in its “natural format” via directives. This is in addition to the automatic recognition of various character string formats.

• A full or selective listing of the resources in a file. Format is similar to that of the Resource Mover, but you get more information with less work.

• A built-in mini editor to view files without leaving Nosy.

Facts and Specifications

MacNosy runs on a 512K Mac or a 1 Meg Lisa under the Workshop O.S. or the Macworks environment.

It is capable of disassembling the resource fork of any application file, ROM, Macsbug, and various resource types in the System file (DRVR, PACK, INIT, CDEF, WDEF, etc). Note that source listing of the WDEF, CDEF procedures come with the MacSupplement.

The released disk contains both the Mac and Lisa versions of MacNosy, some sample “.jrnl’ files to acquaint you with it, source code for the table manager (this may be useful to other developers) and the SfGetFile routines so you can see how it selects files to disassemble.

How does MacNosy work?

When disassembling a file, one must know the structure (code or data) of a given piece of the file. To do this, Nosy uses the fact that every program has a “call graph”. The nodes of the graph are the procedures and the edges are the calls (A calls B, etc). As Nosy is primarily interested in the size of the nodes, it ignores some aspects of the graph (such as recursion) which leads to cycles in the graph. Because of this, the graph reduces to a Directed Acyclic (without cycles) Graph. We can get sloppy in our terminology and refer to the DAG as a “tree of procedures”.

Discovering the size and extent of a procedure is a messy problem that entails disassembling instructions, and looking for the procedure exits. The potential presence of spaghetti code makes the algorithm more complicated.

At this point a reasonable strategy is to treat the file as a collection of code and data blocks (contigious set of bytes). We start at the entry points and walk the tree until all possible procedures have been discovered. The remaining areas are caterogized as “data” blocks. During the tree walk Nosy builds symbol tables for the various categories of labels which are:

Procedure (JSR X) X = proc’nnn’ or the 8 character name following the proc if compiled by Lisa Pascal with the D+ option on.

Global labels ( X(A5) )

X = glob’nnn’

Data labels (LEA X or PEA X)

X = data’nnn’

Common labels (JMP X, Bcc X from another proc) - com_’nnn’

Local labels within a procedure - loc_’nnn’

You can change the names of all but the local labels in Nosy.

Example 1 - A fragment of the resource list of a System file.

Note that for the DITL’s the accompanying text/controls are listed.

      26 resource types, data index =   100
Type FRSV    att   indx  length   name
  ID     1     00   CF12        A        0      0
Type ALRT    att   indx  length   name
  ID  -3997   20   CDBC       C        0        0
  ID  -3996   20   CDCC       C        0        0
  ID  -3995   20   CDDC       C        0        0
  ID  -3994   20   CDEC       C        0        0
Type DITL    att   indx  length   name
  ID  -15936  20   BA6C      1E    
  ID   -6047  20   CA18     1A6    <Initialize> <Eject> <OK> 
                               Do you want to initialize it? 
                               This disk is unreadable: 
                                This disk is damaged: 
                               This is not a Macintosh disk: 
                               Please name this disk: 
                               Initializing disk . . .  
                               Initialization failed! 
                               Initialize this disk? 
  ID   -4000  20   CC7C      A8    <Open> <O> <Cancel> <Eject> <Drive> 
  ID   -3999  20   CD28      90    <Save> <Cancel> Save as: <Eject> <Drive> 

Example 2 - code fragment from a little test program I wrote.

The output listing format is:

aaa: hhhh hhhh ‘cccc’ label opcode address $ssaaaaaa

aaa = segment relative address , hhhh and ccccc are the value of the instruction in hex and ascii. The field ssaaaaaa is the address of any label or symbol reference in the

address field. ss is the segment number of the reference.

I have suppressed leading zeros in most cases and many of the numeric formats use decimal conversion. The macros POP and PUSH have the obvious meaning. The QUAL pseudo implies that all the labels of the form loc_nnn are local to the procedure. The line right after it tells us who calls it. The line with “_Button” is a trap macro. The DNAME macro expands to the 8 character name which is used by Lisabug and Nosy.

    440:                                 QUAL    CHK_USER
                                ; refs - TEST  
    440: 4E56 0000      ‘NV..’  CHK_USER LINK    A6,#0
    444: 4267           ‘Bg’             CLR     -(A7)
    446: A974           ‘.t’             _Button 
    448: 101F           ‘..’             POP.B   D0
    44A: 6714           ‘g.’             BEQ     loc_2               
    44C: 2F0E           ‘/.’             PUSH.L  A6
    44E: 4EBA FFC0      ‘N...’           JSR     WAITBUTT            
    452: 4267           ‘Bg’    loc_1    CLR     -(A7)
    454: A974           ‘.t’             _Button 
    456: 101F           ‘..’             POP.B   D0
    458: 67F8           ‘g.’             BEQ     loc_1               
    45A: 2F0E           ‘/.’             PUSH.L  A6
    45C: 4EBA FFB2      ‘N...’           JSR     WAITBUTT            
    460: 4E5E           ‘N^’    loc_2    UNLK    A6
    462: 4E75           ‘Nu’             RTS     
    464: C348                   data21   DNAME   CHK_USER,0,2

Example 3 - This next routine was dumped to the hardcopy file in “.asm” format.

It is suitable for input to the MDS assembler ASM.

         QUAL    WCR
; refs - TEST 
WCR      LINK    A6,#0
         PUSH.L  glob13(A5)
         PEA     data19
         CLR     -(A7)
         JSR     %W_STR
         PUSH.L  glob13(A5)
         JSR     %W_LN
         PUSH.L  glob12(A5)
         PEA     glob8(A5)
         PUSH    #255
         JSR     %R_STR
         PUSH.L  glob12(A5)
         JSR     %R_LN
         UNLK    A6
data18   DNAME   WCR     ,0,2
; refs - WCR+8  
data19   STR     ‘wait for cr’

Example 4 - Note the Value to Symbol substitution in this ROM fragment listing

 404C12: 50F8 0902      ‘P...’  Launch   S_T     LaunchFlag          
 404C16: 31E8 0004 0936 ‘1....6 loc_2    MOVE    4(A0),CurPageOption 
 404C1C: 2058           ‘ X’             MOVE.L  (A0)+,A0
 404C1E: 43F8 0910      ‘C...’           LEA     CurApName,A1        
 404C22: 7020           ‘p ‘             MOVEQ   #32,D0
 404C24: A02E           ‘..’             _BlockMove  

Example 5 - Sample Reference Map listing fragment of the “System Globals” from ROM

      114 HeapEnd      proc203  MaxMem  proc253  
      118 TheZone      proc201  proc203  GetZone  MaxMem  proc212  proc232 
                       InitResources  proc852  MoreMasters  InitZone 
      11C uTableBase   proc36  proc89  proc96  RDrvrInstall  SystemTask 
                       SystemMenu  OpenDeskacc  BlockMove  com_28

Example 6 - Sample Segment Reference Map listing fragment of Nosy.

Inter seg refs are prefixed with “n/”. This map may be used for procedure balancing.

seg# procedure   fba  blen  refs (seg#/proc) called by
  1] HEAP_OVF    1D6    50   ADD_USED    4/NEW_TBL    
  1] SET_MAX     208   120   CLR_TBL     4/REL_TBLS    3/RTN_PTR    
  1] CLR_TBL     280    46   DI_PROC     3/SEARCH_C    4/DI_FILE     
  1] MOVEUP      2AE    80   ADD_USED   
  1] ADD_ENTR    2FE    42   DI_PROC       ENTER_LA      PUT_REF     
                             ADD_ISPR    3/CHK_PROC    4/NI_FILE     
  1] SET_USED    328    44 4/NI_FILE    

Disassemblling the ROM

I Would like to show a sample listing of a piece or two of ROM but I don’t want to start any fights with Apple’s Lawyers. So like sex, I leave it for you to do it in the privacy of your own home.

I found a few interesting things looking around the ROM. One is an interesting piece of unreachable code at 40AD30 which blasts 32 long words into RAM and then hangs. Another is the “come from” code in the rom patch area in the system heap. In many cases bugs were patched by placing a CMPI.L $40xxxx,28(A7) followed by a suitable jump in unrelated routines. A rather obnoxious example is BlockMove which contains 3 such checks. I will be forming a MacNosy Users Group (Special Interest Group) on the Delphi Information Service (800-544-4005) starting in April to study the ROM and swap “jrnl” files. Admission will be limited to registered owners of MacNosy.

Ordering Information

If ordered from the author before May 1, 1985 cost is $55, including sales tax for CA. residents. After that it will be sold in selected stores or direct for $70. Orders should be addressed to:

Steve Jasik

343 Trenton Way

Menlo Park, Ca. 94025



Community Search:
MacTech Search:

Software Updates via MacUpdate

Microsoft Office 2016 16.11 - Popular pr...
Microsoft Office 2016 - Unmistakably Office, designed for Mac. The new versions of Word, Excel, PowerPoint, Outlook, and OneNote provide the best of both worlds for Mac users - the familiar Office... Read more
Adobe Photoshop CC 2018 19.1.2 - Profess...
Photoshop CC 2018 is available as part of Adobe Creative Cloud for as little as $19.99/month (or $9.99/month if you're a previous Photoshop customer). Adobe Photoshop CC 2018, the industry standard... Read more
Adobe Dreamweaver CC 2018 -...
Dreamweaver CC 2018 is available as part of Adobe Creative Cloud for as little as $19.99/month (or $9.99/month if you're a previous Dreamweaver customer). Adobe Dreamweaver CC 2018 allows you to... Read more
Adobe Flash Player - Plug-in...
Adobe Flash Player is a cross-platform, browser-based application runtime that provides uncompromised viewing of expressive applications, content, and videos across browsers and operating systems.... Read more
Drive Genius 5.2.0 - $79.00
Drive Genius features a comprehensive Malware Scan. Automate your malware protection. Protect your investment from any threat. The Malware Scan is part of the automated DrivePulse utility. DrivePulse... Read more
MegaSeg 6.0.6 - Professional DJ and radi...
MegaSeg is a complete solution for pro audio/video DJ mixing, radio automation, and music scheduling with rock-solid performance and an easy-to-use design. Mix with visual waveforms and Magic... Read more
ffWorks 1.0.7 - Convert multimedia files...
ffWorks (was iFFmpeg), focused on simplicity, brings a fresh approach to the use of FFmpeg, allowing you to create ultra-high-quality movies without the need to write a single line of code on the... Read more
Dash 4.1.5 - Instant search and offline...
Dash is an API documentation browser and code snippet manager. Dash helps you store snippets of code, as well as instantly search and browse documentation for almost any API you might use (for a full... Read more
Evernote 7.0.3 - Create searchable notes...
Evernote allows you to easily capture information in any environment using whatever device or platform you find most convenient, and makes this information accessible and searchable at anytime, from... Read more
jAlbum Pro 15.3 - Organize your digital...
jAlbum Pro has all the features you love in jAlbum, but comes with a commercial license. You can create gorgeous custom photo galleries for the Web without writing a line of code! Beginner-friendly... Read more

Latest Forum Discussions

See All

Around the Empire: What have you missed...
Oh hi nice reader, and thanks for popping in to check out our weekly round-up of all the stuff that you might have missed across the Steel Media network. Yeah, that's right, it's a big ol' network. Obviously 148Apps is the best, but there are some... | Read more »
All the best games on sale for iPhone an...
It might not have been the greatest week for new releases on the App Store, but don't let that get you down, because there are some truly incredible games on sale for iPhone and iPad right now. Seriously, you could buy anything on this list and I... | Read more »
Everything You Need to Know About The Fo...
In just over a week, Epic Games has made a flurry of announcements. First, they revealed that Fortnite—their ultra-popular PUBG competitor—is coming to mobile. This was followed by brief sign-up period for interested beta testers before sending out... | Read more »
The best games that came out for iPhone...
It's not been the best week for games on the App Store. There are a few decent ones here and there, but nothing that's really going to make you throw down what you're doing and run to the nearest WiFi hotspot in order to download it. That's not to... | Read more »
Death Coming (Games)
Death Coming Device: iOS Universal Category: Games Price: $1.99, Version: (iTunes) Description: --- Background Story ---You Died. Pure and simple, but death was not the end. You have become an agent of Death: a... | Read more »
Hints, tips, and tricks for Empires and...
Empires and Puzzles is a slick match-stuff RPG that mixes in a bunch of city-building aspects to keep things fresh. And it's currently the Game of the Day over on the App Store. So, if you're picking it up for the first time today, we thought it'd... | Read more »
What You Need to Know About Sam Barlow’s...
Sam Barlow’s follow up to Her Story is #WarGames, an interactive video series that reimagines the 1983 film WarGames in a more present day context. It’s not exactly a game, but it’s definitely still interesting. Here are the top things you should... | Read more »
Pixel Plex Guide - How to Build Better T...
Pixel Plex is the latest city builder that has come to the App Store, and it takes a pretty different tact than the ones that came before it. Instead of being in charge of your own city by yourself, you have to work together with other players to... | Read more »
Fortnite Will Be Better Than PUBG on Mob...
Before last week, if you asked me which game I prefer between Fortnite Battle Royale and PlayerUnknown’s Battlegrounds (PUBG), I’d choose the latter just about 100% of the time. Now that we know that both games are primed to hit our mobile screens... | Read more »
Siege of Dragonspear (Games)
Siege of Dragonspear 2.5.12 Device: iOS Universal Category: Games Price: $9.99, Version: 2.5.12 (iTunes) Description: Experience the Siege of Dragonspear, an epic Baldur’s Gate tale, filled with with intrigue, magic, and monsters.... | Read more »

Price Scanner via

Sunday Sales: $200 off 13″ Touch Bar MacBook...
Amazon has new 2017 13″ 3.1GHz Touch Bar MacBook Pros on sale this weekend for $200 off MSRP, each including free shipping: – 13″ 3.1GHz/256GB Space Gray MacBook Pro (MPXV2LL/A): $1599.99 $200 off... Read more
B&H drops prices on 15″ MacBook Pros up t...
B&H Photo has dropped prices on new 2017 15″ MacBook Pros, now up to $300 off MSRP and matching Adorama’s price drop yesterday. Shipping is free, and B&H charges sales tax for NY & NJ... Read more
Apple restocks Certified Refurbished 2017 13″...
Apple has restocked Certified Refurbished 2017 13″ 2.3GHz MacBook Pros for $200-$230 off MSRP. A standard Apple one-year warranty is included with each MacBook, models receive new outer cases, and... Read more
13″ Space Gray Touch Bar MacBook Pros on sale...
Adorama has new 2017 13″ Space Gray Touch Bar MacBook Pros on sale for $150 off MSRP. Shipping is free, and Adorama charges sales tax in NY & NJ only: – 13″ 3.1GHz/256GB Space Gray MacBook Pro (... Read more
Best deal of the year on 15″ Apple MacBook Pr...
Adorama has New 2017 15″ MacBook Pros on sale for up to $300 off MSRP. Shipping is free, and Adorama charges sales tax in NJ and NY only: – 15″ 2.8GHz Touch Bar MacBook Pro Space Gray (MPTR2LL/A): $... Read more
Save $100-$150+ on 13″ Touch Bar MacBook Pros...
B&H Photo has 13″ Touch Bar MacBook Pros on sale for $100-$150 off MSRP. Shipping is free, and B&H charges sales tax for NY & NJ residents only: – 13″ 3.1GHz/256GB Space Gray MacBook Pro... Read more
Current deals on 27″ Apple iMacs, models up t...
B&H Photo has 27″ iMacs on sale for up to $150 off MSRP. Shipping is free, and B&H charges sales tax for NY & NJ residents only: – 27″ 3.8GHz iMac (MNED2LL/A): $2149 $150 off MSRP – 27″ 3... Read more
Thursday Deal: 13″ 2.3GHz MacBook Pro for $11...
B&H Photo has the 13″ 2.3GHz/128GB Space Gray MacBook Pro on sale for $100 off MSRP. Shipping is free, and B&H charges sales tax for NY & NJ residents only: – 13-inch 2.3GHz/128GB Space... Read more
How to save $100-$190 on 10″ & 12″ iPad P...
Apple is now offering Certified Refurbished 2017 10″ and 12″ iPad Pros for $100-$190 off MSRP, depending on the model. An Apple one-year warranty is included with each model, and shipping is free: –... Read more
Silver 12″ 1.3GHz MacBook on sale at B&H...
B&H Photo has the 2017 12″ 1.3GHz Silver MacBook on sale for $1399.99 including free shipping plus sales tax for NY & NJ residents only. Their price is $200 off MSRP, and it’s the lowest... Read more

Jobs Board

Art Director, *Apple* Music + Beats1 Market...
# Art Director, Apple Music + Beats1 Marketing Design Job Number: 113258081 Culver City, California, United States Posted: 07-Mar-2018 Weekly Hours: 40.00 **Job Read more
*Apple* Solution Consultant - Apple (United...
# Apple Solution Consultant Job Number: 113569564 Williston, Vermont, United States Posted: 06-Mar-2018 Weekly Hours: 40.00 **Job Summary** Are you passionate about Read more
*Apple* Media Products (AMP) Engineering Man...
# Apple Media Products (AMP) Engineering Manager Job Number: 86497853 Santa Clara Valley, California, United States Posted: 07-Mar-2018 Weekly Hours: 40.00 **Job Read more
QA Automation Engineer, *Apple* Pay - Apple...
# QA Automation Engineer, Apple Pay Job Number: 113202642 Santa Clara Valley, California, United States Posted: 02-Mar-2018 Weekly Hours: 40.00 **Job Summary** At Read more
Lead *Apple* Solution Consultant - Apple (U...
# Lead Apple Solution Consultant Long Island NY Job Number: 113486035 Long Island City, New York, United States Posted: 07-Mar-2018 Weekly Hours: 40.00 **Job Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.