I was an Amiga "user" back in my childhood days. Back then everything was magical, but today I know that it was just science all along. Peeking into old AmigaOS binaries (tools, games) takes the veil of mystery away a bit, and sometimes it's possible to see fun things that are pretty simple when one knows how they work. But, at the same time, one can also appreciate the unexpected complexity of little things that would still be unknown if it weren't for the curiosity.

This post presents a list of standard AmigaOS libraries, available out of the box, ripped from current AmigaOS SDK. This list contains function names together with offsets of these functions (also called Library Vector Offsets, LVO). It's is pretty useful in reverse engineering, because probably all AmigaOS binaries eventually call some system library functions at some point.

An example system call of some AmigaOS Hunk file can look like this:

; Move the function arguments 1 and 2 to the register D1, D2 respectively.
0005f8aa 22 2d 00 08                  move.l          (0x8,A5)=>param_1, D1
0005f8ae 24 2d 00 0c                  move.l          (0xc,A5)=>param_2, D2

; Read a library base instance, from other parts of the code I know that it
; points to `dos.library` instance.
0005f8b2 2c 6c 0f 10                  movea.l         (0xf10,A4), A6

; Call function located at offset -0x1E of the `dos.library` library. By
; using the table from this post we can clearly see that offset -0x1E is
; a reference to the `Open()` function.
0005f8b6 4e ae ff e2                  jsr             (-0x1e, A6)

; The return value of `Open()` is inside the D0 register. We now check if
; the return value has returned 0, or a valid file handle.
0005f8ba 2e 00                        move.l          D0, D7
0005f8bc 4a 87                        tst.l           D7

; Jump if the `Open()` function has succeeded.
0005f8be 66 16                        bne.b           LAB_0005f8d6

; This branch is executed if the `Open()` function has failed.

; Load up the `dos.library` instance into register A6.
0005f8c0 2c 6c 0f 10                  movea.l         (0xf10,A4), A6

; Call the -0x84 function of the `dos.library`. By looking at the table from
; this post, we know that it's a call to the `IoErr()` function.
0005f8c4 4e ae ff 7c                  jsr             (-0x84, A6)

; `IoErr()` will return a "last error" value in the D0 register. Store it to
; the memory under the A4+0x3A offset.
0005f8c8 29 40 00 3a                  move.l          D0, (0x3a,A4)

; ... some later error handling code follows ;)
0005f8cc 70 02                        moveq           # 0x2, D0
0005f8ce 29 40 0e 64                  move.l          D0, (0xe64,A4)
0005f8d2 70 ff                        moveq           # -0x1, D0
0005f8d4 60 02                        bra.b           LAB_0005f8d8
...

So, with Ghidra+AmigaHunkLdr we're able to actually decode the AmigaOS system calls. Probably some automated script would be more helpful than a static table, but can't have everything I guess ;).

Please note that in order to decode the function, you need to have both the offset and the library base handle. The -552 function is different depending on whether the library base is dos or graphics.

If you think this list will be useful to you, you might also be interested in the AmigaOS docs. But probably you already know the site ;).

Enjoy!