Dissassembly of Forth code words with 'see'

Question

I am preparing overall knowledge on building a Forth interpreter and want to disassemble some of the generic Forth code words such as +, -, *, etc.

My Gforth (I currently have version 0.7.3, installed on Ubuntu Linux) will allow me to disassemble colon definitions that I make with the command see, as well as the single code word .. But when I try it with other code words, see + or see /, I get an error that says, Code +, and then I'm not able to type in my terminal anymore, even when I press control-c.

I should be able to decompile/disassemble the code words, as shown by the Gforth manual: https://www.complang.tuwien.ac.at/forth/gforth/Docs-html/Decompilation-Tutorial.html

Has anyone else had this issue, and do you know how to fix it?

Answer 1

Reverting to the old ptrace method did it for me.

First, from the command line as user root run:

echo 0 >/proc/sys/kernel/yama/ptrace_scope

After which see should disassemble whatever it can't decompile. Command line example (need not be root):

gforth -e "see +  bye"

Output:

Code +  
   0x000055a9bf6dad66 <gforth_engine+2454>: mov    %r14,0x21abf3(%rip)        # 0x55a9bf8f5960 <saved_ip>
   0x000055a9bf6dad6d <gforth_engine+2461>: lea    0x8(%r13),%rax
   0x000055a9bf6dad71 <gforth_engine+2465>: mov    0x0(%r13),%rdx
   0x000055a9bf6dad75 <gforth_engine+2469>: add    $0x8,%r14
   0x000055a9bf6dad79 <gforth_engine+2473>: add    %rdx,(%rax)
   0x000055a9bf6dad7c <gforth_engine+2476>: mov    %rax,%r13
   0x000055a9bf6dad7f <gforth_engine+2479>: mov    -0x8(%r14),%rcx
   0x000055a9bf6dad83 <gforth_engine+2483>: jmpq   *%rcx
end-code

Credit: Anton Ertl

Answer 2

Most versions of SEE that I've seen are meant only for decompiling colon definitions. + and / and other arithmetic operations are usually written in assembly code and SEE doesn't know what to do with them. That's why you were getting the CODE error message: they're written in code, not Forth. There are several Forth implementations I've seen that have built in assemblers, but I don't think I've ever seen a dis-assembler. Your best bet for seeing the inner workings of + or / or other such words might be to use DUMP or another such word to get a list of the bytes in the word and either disassemble the word by hand or feed the data into an external disassembler. Or see if you can find the source code for your implementation or a similar one.