How do you disassemble GB/GBC ROMS?

I guess this is kind of a stupid question, but I want to make sure I'm doing it right. The main questions I have are: what are the tools required, what processes are required to get the best results, and is there anything else besides those two things I need to know.

These are the only disassemblers I could find in 5 minutes of google searching. They all look old.

http://www.devrs.com/gb/software.php#disass

Will probably give you a long list of Z80 ASM without understandable labels. And probably don't distinguish between code and data. If you don't know what all the Z80 ASM opcodes do, then these utilities will be a waste of time.

If these are really all there is for GB, then somebody needs to write a better disassembler. Please.

BGB Emulator looks like it has a good debugger, which is like a disassembler, in a way.

http://bgb.bircd.org/

And No cash's GB Emulator too...

http://problemkaputt.de/gmb.htm

Though, I haven't used them.

I disassemble gameboy games by writing an emulator with a code/data logger and then write a gbz80 disassembler to take that cdl data and create a disassembled text file.

Do you mean write a parser that goes line by line through the code, or write an actual emulator?

If you have written an emulator with CDL and written a disassembler...would you be willing to share it with the other kids?

There are a few things I need to fix on it to make it more user friendly. Once that's done ill post it.

The one sort of confident disassember I found recommended using No Cash's debugger for any serious work. So yeah, that kind of says something.

It's common in GB software to have inline data (function arguments, in high-level language terms) after certain call or rst instructions. Code/data logging in an emulator can help identify this to some extent, but when dealing with a large and complex game such as an RPG it's unrealistic to expect to log every bit of code in a ROM (especially since many games contain unused code--hello, TCRF!) It's handy just to be able to give the disassembler rules such as "after every call 017d or call 04bf, the next three bytes are the address and bank number of a routine to call" or "after every rst 18 the next byte is a signature byte, and if that byte is 05 then the 16 bytes after that are a jump table".

I've been working on a GB disassembler that supports this kind of extension (actually a whole series of disassemblers--currently GB, 6502 family, and uPD772x family) but it's not a standalone application, it's a python module designed to be called from a script that provides the game-specific rules along with code/data labelling, ROM-offset-to-CPU-address mapping, etc.

Can you give an example of this? I'm curious as to how these routines access their arguments and fix the return address.

Alright I have fixed what I needed to fix and here it is.

Both the examples I gave were from real games. call 017d is Final Fantasy Legend 2, and rst 18 is Final Fantasy Legend 3.

Accessing the arguments is pretty simple. FFL3 just does this, since there's only one argument byte and it doesn't care about preserving registers at this point:



FFL2 is a bit more complicated:

Neat, thanks. The FFL3 trick is pretty classy but the FFL2 code is about as nasty as I expected this would be.