views:

130

answers:

3

I'm trying to understand an old classic Mac application's entry point. I've disassembled the first CODE resource (not CODE#0, which is the jump table). The code refers to some variables off the stack: a word at 0004(A7), an array of long words of starting at 000C(A7) whose length is the value at 0004(A7), and a final long word beyond that array that seems to be a pointer to a character string.

The array of long words looks like strings at first glance, so it looks superficially like we're dealing with an (int argc, char ** argv) situation, except the "argv" array is inline in the stack frame.

What should a program be expecting on its stack / registers when it first gets called by the Mac OS?

+2  A: 

From memory I don't think there is anything of interest on the stack when your CODE resource is first called. Classic Mac OS did not use argc/argv. It's been a long time though, so I could be wrong, and I threw out all my old Inside Mac volumes some years ago, so I can't easily check.

Paul R
Indeed, it seems the only thing you get on entry to a MacOS classic binary is A5 pointing to the "A5 world". I was looking at the first code in CODE segment 1, which is _not_ the same thing as the code referred to by the first entry in the jump table stored in CODE segment 0. Thanks for your help.
John Källén
Ah yes - the A5 world - QuickDraw globals and your program globals - I'd forgotten about that.
Paul R
+4  A: 

I don't know if it's any use (I only looked at this question because it had 68000 in the title...!) but ye olde Mac development information seems to be here:

http://developer.apple.com/legacy/mac/library/documentation/macos8/mac8.html

(Conjecture: the argv data may well actually be on the stack. An obvious way to split the command line into parts would be to start at the end rather than the beginning. Walk the command line backwards (using the -(An) addressing mode) and find the pieces that way. This potentially complicates things a little bit, but 68000 can compare immediate values to memory so it's no great hassle to check for \ and the like (if Mac OS does that). Once the start of a piece is found, put its address on the stack -- you've probably got the start handy (due to predecrement) but PEA would make this easy in any event -- and poke a 0 into its end to terminate it. Once all the pointers have been pushed, the loader could do MOVEA.L A7,-(A7) or PEA A7 to push the argv pointer.

(This would probably work out quite well if you coded it up and so it wouldn't surprise me if it was the approach actually taken.)

brone
Thanks for the link, it will become very handy. Alas, I was looking at the wrong code thinking it was the entry point; it seems to be some hard-code handwritten assembler fragment to do something clever with an array of strings which, yes, appears to be wholly on the stack.
John Källén
@John: see in particular http://developer.apple.com/legacy/mac/library/documentation/mac/Processes/Processes-15.html#HEADING15-0. Perhaps you're seeing C runtime library which constructs an argc and argv.
Potatoswatter
A: 

I suppose you're using ResEdit but just to be sure you have the CODE editor, which is one of the friendliest disassemblers ever. It doesn't do interactive reassembly, but it comes pretty close.

Potatoswatter