Aira Force - an interactive reassembler

[hop]

V0.6.2 packages are now available, addressing some stability issues.

https://howprice.itch.io/aira-force

[kamelito]

Will try tonight

[hop]

Originally Posted by kamelito

Will try tonight

I've just tried aira-force-win64.zip Version 0.6.2 on a fresh Windows 11 laptop and it seems to be running fine (except for desktop scaling blurriness). C:\Windows\System32\openg32.dll is there and showing file version 10.0.2262.2506. I suspect there may a problem with your graphics card drivers.

[kamelito]

probably I got:
Aira Force V0.6.2
Platform: Windows
Windows 10.0 (OS Build 22635)
Failed to initialize OpenGL loader!
Failed to initialise OpenGL3

[hop]

Originally Posted by kamelito

probably I got:
Aira Force V0.6.2
Platform: Windows
Windows 10.0 (OS Build 22635)
Failed to initialize OpenGL loader!
Failed to initialise OpenGL3

Yes, unfortunately RtlGetVersion returns Windows 10 for Windows 11. The machine I tested on today was 10.0 22631, but it was tested by another Windows 11 user a couple of months ago. Is 22635 an insider build? There is a slim chance this could break things I guess. I'm afraid all I can recommend is re-installing your graphics card drivers. Perhaps test another OpenGL application if you can find one. If anyone else reports this problem then I will look into it, and I could consider using an alternative renderer (D3D) for Windows. As it stands, it sounds like you may have a funny configuration somehow on your machine.

[kamelito]

@Hop, I tried GLTron and it works, dunno which version of OpenGL it uses though.

[hop]

Originally Posted by kamelito

@Hop, I tried GLTron and it works, dunno which version of OpenGL it uses though.

What does https://www.dependencywalker.com/ say the opengl32.dll path is for AiraForce.exe? You may have to select "view full paths"

[kamelito]

I reinstalled windows, try again Airforce was complaining about VCRUNTIME140.dll etc missing which I resolved downloading the file below, now it works pfew

https://learn.microsoft.com/en-us/cp...-2019-and-2022
Nice tool, congrats.

[hop]

Originally Posted by kamelito

now it works pfew

The nuclear option! I really hope you find it useful!

[kamelito]

Originally Posted by hop

The nuclear option! I really hope you find it useful!

you bet it will, I familiar with tools like IRA, Resource and Dis so yeah it will be useful.

[kamelito]

In Frontier (cd32 version used) I see many times the machine code e9c4640c (followed by 47f36200 etc) which is not disassembled as code when I choose code. It should be bfextu d4{16:12},d6 in this case etc.
Is suppose that dislib could be used too?
https://aminet.net/package/util/libs/DisLib

[hop]

Originally Posted by kamelito

In Frontier (cd32 version used) I see many times the machine code e9c4640c (followed by 47f36200 etc) which is not disassembled as code when I choose code. It should be bfextu d4{16:12},d6 in this case etc.

Have you set the machine type to 68020? This can be done in three ways:
1. Preprocess dialog, if you are starting a new analysis
2. In the Ira Config window, for a WIP analysis
3. By manually editing the .cnf file

I've tested on Frontier and both the ira and Aira Live Analysis (WIP) don't auto-identify the BFEXTU instructions, so they are classed as data (== not code or text). However, if you press C to convert to code then the disassembly looks fine, so ira understands these instructions. For example, disassembling the Frontier executable from Frontier - Elite II v1.10 (1994)(Gametek - Konami)[!].iso, with entry $10000 and offset $10000 we have (after pressing 'C' at this address)

LAB_72274:
	BFEXTU	D4{$10:$C},D6		;72274: e9c4640c
	LEA	0(A3,D6.W*2),A3		;72278: 47f36200
	BFEXTU	D4{$1C:4},D6		;7227c: e9c46704
	ADD.W	D6,D5			;72280: da46

I'm only really familiar with the 68000 instruction set, and haven't spent any time on 68020+ instructions, so please let me know if I've missed something here.

Originally Posted by kamelito

Is suppose that dislib could be used too?
https://aminet.net/package/util/libs/DisLib

Thanks for making me aware of this. I'll check it out.

[kamelito]

IIRC I start it as 68000 then 68020, maybe the config was not taking the change into account.
Trojan:Win32/Wacatac...

[kamelito]

Virus alert on version 64bit of AirForce 0.63 not in the 32bit version.

[hop]

Originally Posted by kamelito

Virus alert on version 64bit of AirForce 0.63 not in the 32bit version.

Which application is reporting this?

It's obviously a false positive.

[kamelito]

Defender Microsoft, is IRA/Airforce supporting disassembly of .library ? see my post in IRA tutorial

[hop]

Originally Posted by kamelito

Defender Microsoft, is IRA/Airforce supporting disassembly of .library ? see my post in IRA tutorial

I've never tried. I don't know if a .library has a different structure to an Object Module, or is just a special case. I'll try asap.

[copse]

No need to use any of this but maybe it is helpful. When I was writing my interactive disassembler (not recommended for use!) which loaded Amiga, Atari ST and X68k executables, I wrote up notes in my wiki.

Here's my notes on hunks (with pseudo code): http://amiga-dev.wikidot.com/file-format:hunk

The implementation the pseudo-code came from is here: https://github.com/rmtew/peasauce/bl...ga/hunkfile.py

I also tried all the compilers and assemblers I could get my hands on and documented the debug formats for symbols (it is very possible IRA already incorporates all of these perhaps even better) and that is in that hunk wiki page:

http://amiga-dev.wikidot.com/file-format:hunk#toc24

[kamelito]

@hop, I think that it is a bug in Aira force as I tried directly IRA in the command line and it is working.
IRA has for now a limitation, you cannot set the size of datatype to .b .w or .l so sometimes this lead to bad disassembly.
PHX knows about but I don't know when it will be implemented.

[hop]

Originally Posted by kamelito

@hop, I think that it is a bug in Aira force as I tried directly IRA in the command line and it is working.

This is a feature I have never considered. Great that ira supports .library files. I'll look into it thanks.

Originally Posted by kamelito

IRA has for now a limitation, you cannot set the size of datatype to .b .w or .l so sometimes this lead to bad disassembly.
PHX knows about but I don't know when it will be implemented.

I'm not sure what this means. What do you mean by "datatype". Do you mean EQUs?