Using ReSource

ReSource in some ways can be likened to a text editor as it contains a buffer area whose data is displayed by following a given set of rules. With a text editor, it is changes in the data, ie the text being manipulated, that results in the final display changing, but with ReSource, the data, namely the program being looked at, will often remain constant. Instead it is the rules being used to generate the display that get changed, either by ReSource making intelligent decisions about how particular parts of the program should be displayed, or by you the user directing ReSource to take a particular view. 

Consider for example this following set of eighteen bytes that were part of one of the programs I've disassembled in trials over the last few weeks:

$69, $6E, $74, $75, $69, $74, $69, $6F, $6E, $2E, $6C, $69, $62, $72, $61, $72, $79, $0

You could, once a preliminary disassembly revealed that these values do not represent valid 68k instructions, leave them as displayed byte constants, ie dc.b values. Alternatively you could direct ReSource to display them as the following long-word dc.l and byte dc.b constants like this:
 
dc.l $69, $6E, $74, $75
dc.l $69, $74, $69, $6F
dc.l $6E, $2E, $6C, $69
dc.l $62, $72, $61, $72
dc.b $79 
dc.b $0


These are typical of the type of disassembly decisions that are normally left up to the programmer and it is exactly this area where ReSource's 'intelligence' comes to the fore. In fact, left to its own devices ReSource came up with this interpretation:
 
intuitionlibr.MSG dc.b 'intuition.library',0


Not only had it decided that the bytes represented a null terminated text string but it had realised that the bytes were connected with the intuition library and given the bytes a meaningful name! In this particular case I knew exactly what the original code looked like because the program I was disassembling was one that I had written. It was however rather un-nerving to say the least when I realised that ReSource had perfectly, and quite automatically, disassembled a statement which had originally read:

intuition_name dc.b 'intuition.library', 0


Coincidence? Not a chance and in the same program ReSource had identified and labelled similar DOS and graphics library name definitions. At the same time it had provided a preliminary disassembly listing that used the labels that it had created.

The first few lines of the ReSource disassembly of the above program actually looked like this:

ProgStart MOVEA.L #doslibrary.MSG,A1
  MOVE.L #0,D0
  MOVEA.L (4).W,A6
  JSR  (-$228,A6)
  MOVE.L D0,(lbL000264)

and with the tell-tale loading of register a6 followed by an indirect subroutine call, it was pretty obvious that these instructions represented an Amiga run-time library call. ReSource had rightly decided that the value returned in d0 was being stored in a long word variable and had subsequently identified those locations, produced a suitable lbL label, and then used that label in its disassembly. Knowing that location 4 is the Amiga's _AbsExecBase (which holds a pointer to the Exec library) the next step was to identify the Exec function being used. Normally this involves looking up a list of function references (in the RKM manuals or similar) to see which function has a library vector offset (LVO) of -$228. With ReSource however this is not necessary - you just select 'Exec library' from the symbol menus and -$228 is immediately converted to the appropriate function reference (in this case _LVOOPenLibrary). 

Since it was obvious that this fragment of code has already loaded a 'dos.library' text pointer into register a1 it was equally obvious that the OpenLibrary() function was going to return the DOS library's base pointer (usually called _DOSBase). At this point I was in the disassembly positioned at the instruction which read MOVE.L D0,(lbL000264), so I selected 'Forward Reference' (which took me to the long word defined by ReSource as lbL000264) and simply edited the label name accordingly. 

Guided by the information and labelling originally assigned by ReSource, it takes only minutes to modify the original disassembly listing to produce something which read like this:

ProgStart MOVEA.L #doslibrary,A1
  MOVE.L #0,D0
  MOVEA.L (_AbsExecBase).W,A6
  JSR  (_LVOOpenLibrary,A6)
  MOVE.L D0,(_DOSBase)