Firmware Hacking of the REB1200

In our first article on the REB1200 we discussed some of the options available for modifying the device.   In the second, we provided a little more information on the most straightforward method of getting firmware into the device.

But what will we do once we’re “inside”?   Let’s find out.

We understand that some of our readers won’t be assembly nuts, or really even that versed in machine language.   Well let’s get you up to speed: The coldfire processor in the REB is running Motorola 68k compatible code.   One good guide to the 68k instruction set is found on the 68k page at ticalc.org (originally written for hacking TI calculators – cool!).

The processor is big-endian so disassembly is pretty easy to read.   For example, moving the value $F1234567 into address pointer a0 so you can fetch memory from this location consists of:

20BC F123 4567                                         move.l   #$F1234567,(a0)

Let’s dissect it.   On the left, you can see the opcodes – 20BC: move.l from literal to a0 pointer.   In 68k, you the instruction reads from left to right – take number, put into (a0) – this is opposite of intel x86.   So we are taking a literal value (actual value, literals denoted by #), and putting it directly into the a0 register.   Putting something into the address register itself requires the parentheses – normally you use the a registers as a pointer, where you want to put some data AT the memory location held in a0.

Example: To set a0 to the ram location F12345678, and then store the value BAADF00D into the ram location F2345678 you may see..

move.l #$F1234567, (a0)

move.l #BAADF00D, a0

Now F1234567 holds the value BAADF00D.   The l in move.l denotes a long move – move 4 bytes.   You can also do byte move (b) or word move (w).   the b/w/l notation works with move and most of the mathematical add, subtract, etc, instructions so you will see it a lot.

Now you know the tiniest fraction of addressing and data manipulation.   You will also run into quite a few branch instructions, that start with B’s.   These instructions jump, or conditionally jump, the program execution to a new routine address.   You may see BRA – unconditional branch, or BCC – branch if not carry, or BNE – branch if the two values compared previously are not equal…   Or about 12 other types of branches.   These are used to implement conditional jumps such as IF statements.

Now I don’t intend this to be a tutorial on 68k – just a peek so unfamiliar readers can at least decide if they’d like to read up and jump into the machine code.   Delve deeper with your Pikmin squad?

Continued on next page €¦