Sonic Advance 1 GBA Matching Decompilation Test

Hello folks, back from a 10 year hiatus from this site. I'm making this post mainly to document what I do and what it has to do with the Sonic franchise.

Long story short, I found out a little while back that Sonic Advance 1 (I only examined the US ROM) appears to use a version of gcc around 2.95. Here's proof:

Original assembly:

Code (Text):

1.     THUMB_FUNC_START sub_08001930
2. sub_08001930: @ 0x08001930
3.     ldr r3, _08001948
4.     ldr r2, [r3]
5.     cmp r2, #0x7f
6.     bgt _08001950
7.     ldr r1, _0800194C
8.     lsls r0, r2, #2
9.     adds r0, r0, r1
10.     ldr r0, [r0]
11.     adds r1, r2, #1
12.     str r1, [r3]
13.     b _08001952
14.     .align 2, 0
15. _08001948: .4byte 0x03001B3C
16. _0800194C: .4byte 0x03001220
17. _08001950:
18.     movs r0, #0
19. _08001952:
20.     bx lr

Proposed C code:

Code (Text):

1. #include "global.h" // ignore this, i have it included in my test setup for basic types and such.
2.  
3. extern s32 gUnknown_03001B3C;
4. extern u32 gUnknown_03001220[];
5.  
6. u32 sub_08001930(void)
7. {
8.     int retVar;
9.     if(gUnknown_03001B3C > 0x7f)
10.         return 0;
11.     retVar = gUnknown_03001220[gUnknown_03001B3C++];
12.     return retVar;
13. }

Output asm on -O2 -mthumb-interwork for gcc 2.95.1 (using the gcc included with GBA SDK)

Code (Text):

1. sub_08001930:
2.  
3.         push    {lr}
4.  
5.  
6.         ldr     r3, .L5
7.         ldr     r2, [r3]
8.         cmp     r2, #0x7f
9.         bgt     .L3       @cond_branch
10.  
11.         ldr     r1, .L5+0x4
12.         lsl     r0, r2, #0x2
13.         add     r0, r0, r1
14.         ldr     r0, [r0]
15.         add     r1, r2, #0x1
16.         str     r1, [r3]
17.  
18.         b       .L4
19. .L5:
20.         .word   gUnknown_03001B3C
21.         .word   gUnknown_03001220
22. .L3:
23.  
24.         mov     r0, #0x0
25. .L4:
26.  
27.         pop     {r1}
28.         bx      r1

If you note the extra push/pops, I actually figured that out a little while ago. They're seemingly a gcc difference between the GBA SDK version and stock gcc, so if you build a stock gcc 2.95.1 for ARM Thumb target, this will match. I honestly don't know if it would be worth it to build a disassembly of the Sonic Advance and do the matching decompilation approach like what pret does though, but it might produce some interesting findings. Can't say for certain if the later Advance titles use the same language or codebase or even a similar compiler but if they do they might be worth looking into.

 

I use https://github.com/camthesaxman/gbadisasm to pull functions via a cfg that can be defined via IDA scripts. I don't need IDA though. You can use it to casually view the assembly of blobs by the process of repeatedly adding the function addrs to your config and repeat the disasm via cam's program.