Sonic Advance 1 GBA Matching Decompilation Test

Discussion in 'Engineering & Reverse Engineering' started by Excalibur, Nov 11, 2019.

  1. Revo

    Revo

    Previously Excalibur Member
    33
    2
    8
    Nope.
    Hello folks, back from a 10 year hiatus from this site. I'm making this post mainly to document what I do and what it has to do with the Sonic franchise.

    Long story short, I found out a little while back that Sonic Advance 1 (I only examined the US ROM) appears to use a version of gcc around 2.95. Here's proof:

    Original assembly:
    Code (Text):
    1.     THUMB_FUNC_START sub_08001930
    2. sub_08001930: @ 0x08001930
    3.     ldr r3, _08001948
    4.     ldr r2, [r3]
    5.     cmp r2, #0x7f
    6.     bgt _08001950
    7.     ldr r1, _0800194C
    8.     lsls r0, r2, #2
    9.     adds r0, r0, r1
    10.     ldr r0, [r0]
    11.     adds r1, r2, #1
    12.     str r1, [r3]
    13.     b _08001952
    14.     .align 2, 0
    15. _08001948: .4byte 0x03001B3C
    16. _0800194C: .4byte 0x03001220
    17. _08001950:
    18.     movs r0, #0
    19. _08001952:
    20.     bx lr
    Proposed C code:
    Code (Text):
    1. #include "global.h" // ignore this, i have it included in my test setup for basic types and such.
    2.  
    3. extern s32 gUnknown_03001B3C;
    4. extern u32 gUnknown_03001220[];
    5.  
    6. u32 sub_08001930(void)
    7. {
    8.     int retVar;
    9.     if(gUnknown_03001B3C > 0x7f)
    10.         return 0;
    11.     retVar = gUnknown_03001220[gUnknown_03001B3C++];
    12.     return retVar;
    13. }
    Output asm on -O2 -mthumb-interwork for gcc 2.95.1 (using the gcc included with GBA SDK)
    Code (Text):
    1. sub_08001930:
    2.  
    3.         push    {lr}
    4.  
    5.  
    6.         ldr     r3, .L5
    7.         ldr     r2, [r3]
    8.         cmp     r2, #0x7f
    9.         bgt     .L3       @cond_branch
    10.  
    11.         ldr     r1, .L5+0x4
    12.         lsl     r0, r2, #0x2
    13.         add     r0, r0, r1
    14.         ldr     r0, [r0]
    15.         add     r1, r2, #0x1
    16.         str     r1, [r3]
    17.  
    18.         b       .L4
    19. .L5:
    20.         .word   gUnknown_03001B3C
    21.         .word   gUnknown_03001220
    22. .L3:
    23.  
    24.         mov     r0, #0x0
    25. .L4:
    26.  
    27.         pop     {r1}
    28.         bx      r1
    If you note the extra push/pops, I actually figured that out a little while ago. They're seemingly a gcc difference between the GBA SDK version and stock gcc, so if you build a stock gcc 2.95.1 for ARM Thumb target, this will match. I honestly don't know if it would be worth it to build a disassembly of the Sonic Advance and do the matching decompilation approach like what pret does though, but it might produce some interesting findings. Can't say for certain if the later Advance titles use the same language or codebase or even a similar compiler but if they do they might be worth looking into.
     
    • Like Like x 2
    • Informative Informative x 1
    • List
  2. MarkeyJester

    MarkeyJester

    My predecessors have nothing on me. Resident Jester
    I think if it's possible to recompile it as 1:1, then a matching decompilation would definitely be the way to go in my book.
     
  3. biggestsonicfan

    biggestsonicfan

    Model2wannaB Oldbie
    1,046
    52
    28
    Formerly Sonic the Fighters
    Where are you getting your original disassembly from? Is the disassembler not specifically targeted for GNU GCC?
     
  4. Revo

    Revo

    Previously Excalibur Member
    33
    2
    8
    Nope.
    I use https://github.com/camthesaxman/gbadisasm to pull functions via a cfg that can be defined via IDA scripts. I don't need IDA though. You can use it to casually view the assembly of blobs by the process of repeatedly adding the function addrs to your config and repeat the disasm via cam's program.
     
  5. True Dude

    True Dude

    Member
    1,316
    1
    18
    Very interesting. I'd love to need around with a fully decompiled version of this. There's always the Android port source, but that's in Java, which I'm not familiar with nor interested in learning for one hobby project.
     
  6. MainMemory

    MainMemory

    Every day's the same old thing... Same place, diff Tech Member
    4,340
    32
    28
    SonLVL
    Getting Sonic Advance's code in C rather than Java would be a great thing to have.