NVM, looked through files and found my copy is Pro.
However, if anyone needs help getting a copy of IDA Pro 6.6, I have a copy sitting around. Just PM Me.
Last edited by RealLatias,
Hacking Firmware Reverse Engineering (Info Dump)
- Thread starter NWPlayer123
- Start date
- Views 54,736
- Replies 151
- Likes 82
However, if anyone needs help getting a copy of IDA Pro 6.6, I have a copy sitting around. Just PM Me.
If only devs could understand that people buy consoles to play games, not shitty homebrews
There are a few difference in the way I process the PPC kernel.bin after it's decrypted.
Instead of editing the actual file, I tell IDA to start in 0x100 bytes using Input File/File Offset
Code:
ROM Start Address - 0xFFE00100
ROM Size - 0x11E100
Input File
Loading Address - 0xFFE00100
File Offset - 0x100
Loading Size - 0x11E000I also un-check the Analysis Enabled box until after I set the Segments and I set the Analysis / Kernel Options1 / Make Final Analysis Pass to checked to compress all of the freespace.
After it's loaded, before I turn on the Analysis, I proces the segments like this:
SegCreate(0xFFE01F00, 0xFFE80000, 0, 1, 1, 2);
SegCreate(0xFFE84400, 0xFFEE0000, 0, 1, 1, 2);
SegCreate(0xFFF1E200, 0xFFFFFFFE, 0, 1, 1, 2);
SegClass(0xFFE01F00, "DATA");
SegClass(0xFFE84400, "CONST");
SegClass(0xFFF1E200, "DATA");
SegRename(0xFFE01F00, "Data");
SegRename(0xFFE84400, "Const");
SegRename(0xFFF1E200, "Data");
You can create an IDA script with this, or just paste it into the command line at the bottom of the screen
(either Python or IDC will work)
The reason I do it this way is if you don't set the segments before the analysis, IDA thinks the Strings and Data might be code and she processes part of them as such.
Other than that, I use the kernel as just that, the kernel for adding in other files and seeing how they work together.
Of most interest is the kernel and coreinit...
.
.
But almost all of my focus right now is ARM/Thumb and the FW.IMG code as it handles most all of the "fun stuff" needed for CFW.
Last edited by Datalogger,
Lol, but devs don't buy consoles for your gain or to work for you. Just like you, it's for there own purposes and what they want is homebrew. They only need to serve themselves and owe nobody else anything. Anything you do gain from reverse engineering is just lucky for you because you can't do it yourself unless you can be bothered to learn. If you want free games with the console you bought how about you do it yourself or simply buy them, if you can't afford them then why buy a console that can't natively do what you want. It didn't say anywhere on the box it could.
Last edited by ARVI80,
FYI there are other decompilers that work with ppc some better then hex rays.
https://code.google.com/archive/p/miasm/ Not too bad but lacking user friendly GUI.
http://metasm.cr0.org/ I really like this one.
And of course my favorite.....http://www.capstone-engine.org/
But you need this with it...https://github.com/cseagle/fREedom
Don't mean to clutter your thread NW but some users may need some tooling and may not be aware of all the options out there.
https://code.google.com/archive/p/miasm/ Not too bad but lacking user friendly GUI.
http://metasm.cr0.org/ I really like this one.
And of course my favorite.....http://www.capstone-engine.org/
But you need this with it...https://github.com/cseagle/fREedom
Don't mean to clutter your thread NW but some users may need some tooling and may not be aware of all the options out there.
Disassembling and decompiling are two different things, disassembling is just turning a bytecode binary or ELF and producing lots of text for all the instructions and how they link, decompiling produces pseudocode from that to be readable in higher-level languages like C, which isn't entirely accurate because it's impossible sometimes to know what guesses the original compiler used.
Tho, those do look like really good alternatives to IDA, I'll have to try some others out. There's still the issue of Capstone not supporting Paired Singles but that's only a minor issue and could probably be worked around
For example, this would not get any output for the psq instructions:
The snowman IDA plugin works like a charm for me! Saved me many a hour of work on smash 4's rpx.
Who's saying they should work for me? All I'm saying is that if they want to do something useful then just unlock the system completely instead of only opening a small window so they can show off their shit taste releasing retarded incomplete projects or ports of some obnoxious indie game nobody ever asked for.
Sorry to ask for support here, but the OSv10 file isn't available for download. I tried both JNUSTool and NUSGrabberGUI, and neither support downloading the OSv10.
EDIT: IGNORE ME, I'M AN IDIOT THAT CAN'T READ.
Last edited by RealLatias,
What version are you using? It always seems to interpret it wrong, like it's expecting x86 and produces this garbled mess with __asm__ blocks and eax/ebx registers
I got OSv10 using NWPlayer's NusDownloader, but all there is is a bunch of files and .app files along with a cetk......
should I download the OSv10 from somewhere else?
Last edited by RealLatias,
Snowman mostly likely also needs additions to be 100% compatible.
https://github.com/yegord/snowman/t.../src/3rd-party/capstone/capstone/arch/PowerPC
https://github.com/yegord/snowman/tree/master/src/3rd-party/capstone/capstone/arch/PowerPC
https://github.com/yegord/snowman/t.../src/3rd-party/capstone/capstone/arch/PowerPC
https://github.com/yegord/snowman/tree/master/src/3rd-party/capstone/capstone/arch/PowerPC
Last edited by Bug_Checker_,
, Reason: Better link
That works loads better <3 it'll do for now, just needs some 32-bit clamping so it doesn't spit out an extra ffffffff every function definition (which I deleted in the below image)
A little food for thought on the PPC Kernel loading.
I haven't look at this area too much, but here's where the ARM processes kernel.img for loading into the PPC's memory.
I've added in the SysCalls and a few other misc functions into the comments, but it still needs more investigation.
I'll re-visit this and add to it as soon as I'm done with the current re-map I'm working on in the Boot0/Boot1 Segments...
.
I haven't look at this area too much, but here's where the ARM processes kernel.img for loading into the PPC's memory.
I've added in the SysCalls and a few other misc functions into the comments, but it still needs more investigation.
I'll re-visit this and add to it as soon as I'm done with the current re-map I'm working on in the Boot0/Boot1 Segments...
Code:
IOS_MCP:05033FF4 LDR R1, =byte_40C ; Load from Memory
IOS_MCP:05033FF6 BL Call_SysCall_0x52 ; void IOS_FlushDCache(void *ptr, unsigned int len)
IOS_MCP:05033FF6 ; Flush data cache
IOS_MCP:05033FF6 ; -> Nothing
IOS_MCP:05033FFA LDR R0, =0x1FFF000 ; Load from Memory
IOS_MCP:05033FFC BL set_ppc_boot_params ; SysCall_0x6D
IOS_MCP:05033FFC ; int set_ppc_boot_params(void *params)
IOS_MCP:05033FFC ; Registers the supplied address as a pointer for setting up the PPC boot parameters
IOS_MCP:05033FFC ; -> 0 on success
IOS_MCP:05033FFC ;
IOS_MCP:05034000 ORRS R4, R6 ; Rd = Op1 | Op2
IOS_MCP:05034002 ORRS R5, R0 ; Rd = Op1 | Op2
IOS_MCP:05034004 ORRS R4, R5 ; Rd = Op1 | Op2
IOS_MCP:05034006 BEQ loc_503400A ; Branch
IOS_MCP:05034008 B Set_Error_Msg ; Branch
IOS_MCP:0503400A
IOS_MCP:0503400A loc_503400A ; CODE XREF: sub_5033C50+3B6j
IOS_MCP:0503400A MOVS R0, #0x80 ; Load 0x80 into R0
IOS_MCP:0503400C MOVS R1, #0x90 ; Load 0x90 into R1
IOS_MCP:0503400E LSLS R0, R0, #0x14 ; Shift 0x80 to 0x8000000
IOS_MCP:05034010 LSLS R1, R1, #0xD ; Shift 0x90 to 0x120000
IOS_MCP:05034012 BL load_ppc_kernel ; SysCall_0x77
IOS_MCP:05034012 ; int load_ppc_kernel(u32 address, u32 size) - Maps the PPC kernel image memory:
IOS_MCP:05034012 ; address == 0x08000000
IOS_MCP:05034012 ; size == 0x00120000
IOS_MCP:05034012 ; ->0 on success
IOS_MCP:05034012 ;
IOS_MCP:05034016 MOVS R4, R0 ; copy R0 to R4 (load status return value)
IOS_MCP:05034018 CMP R0, #0 ; Check if PPC Kernel load was OK (0=Good)
IOS_MCP:0503401A BEQ loc_503401E ; Branch here if good
IOS_MCP:0503401C B Set_Error_Msg ; Branch here if bad load
IOS_MCP:0503401E
IOS_MCP:0503401E loc_503401E ; CODE XREF: sub_5033C50+3CAj
IOS_MCP:0503401E LDR R1, =aKernel_img ; Load the location of string "kernel.img" into R1
IOS_MCP:05034020 MOVS R4, R7 ; Copy R7 into R4
IOS_MCP:05034022 ADDS R4, #0x30 ; Add 0x30 to R4
IOS_MCP:05034024 STR R1, [SP,#0x19C+var_19C] ; Store to Memory
IOS_MCP:05034026 MOVS R5, #0xC6 ; Load 0xC6 into R5
IOS_MCP:05034028 MOVS R1, #0x80 ; Load 0x80 into R1
IOS_MCP:0503402A LDR R2, =aSS ; Load string "%s/%s" into R2
IOS_MCP:0503402C LDR R3, =dword_50B7FD0 ; Load from Memory
IOS_MCP:0503402E MOVS R0, R4 ; Rd = Op2
IOS_MCP:05034030 LSLS R1, R1, #1 ; Left shift 0x80 to 0x100 = Offset to start of PPC Kernel Image in kernel.img
IOS_MCP:05034032 LSLS R5, R5, #1 ; Shift R5 to 0x18c
IOS_MCP:05034034 BL sub_5059010 ; Branch with Link
IOS_MCP:05034038 ADDS R3, R7, R5 ; Rd = Op1 + Op2
IOS_MCP:0503403A STR R3, [SP,#0x19C+var_19C] ; Store to Memory
IOS_MCP:0503403C MOVS R0, #1 ; Rd = Op2
IOS_MCP:0503403E MOVS R2, #0x80 ; Load 0x80 into R2
IOS_MCP:05034040 MOVS R3, #0x90 ; Load 0x90 into R3
IOS_MCP:05034042 STR R0, [SP,#0x19C+var_198] ; Store to Memory
IOS_MCP:05034044 MOVS R1, #0 ; Set R1 = 0x00
IOS_MCP:05034046 MOVS R0, R4 ; Rd = Op2
IOS_MCP:05034048 LSLS R2, R2, #0x14 ; Left shift to =0x8000000 = PPC Kernel Start
IOS_MCP:0503404A LSLS R3, R3, #0xD ; Left shift to =0x120000 = PPC Kernel Size
IOS_MCP:0503404C BL sub_50170FC ; Branch with Link
IOS_MCP:05034050 MOVS R1, #0x120000 ; PPC Kernel Size
IOS_MCP:05034054 MOVS R4, R0 ; Rd = Op2
IOS_MCP:05034056 MOVS R0, #0x8000000 ; PPC Kernel Mem Start Address
IOS_MCP:0503405A BL Call_SysCall_0x52 ; void IOS_FlushDCache(void *ptr, unsigned int len)
IOS_MCP:0503405A ; Flush data cache
IOS_MCP:0503405A ; -> Nothing
IOS_MCP:0503405E CMP R4, #0 ; Set cond. codes on Op1 - Op2
IOS_MCP:05034060 BEQ loc_5034064 ; Branch
IOS_MCP:05034062 B Set_Error_Msg ; Branch
IOS_MCP:05034064
IOS_MCP:05034064 loc_5034064 ; CODE XREF: sub_5033C50+410j
IOS_MCP:05034064 MOVS R0, #0x8000000
IOS_MCP:05034068 MOVS R1, #0 ; Rd = Op2
IOS_MCP:0503406A BL load_ppc_kernel ; SysCall_0x77
IOS_MCP:0503406A ; int load_ppc_kernel(u32 address, u32 size) - Maps the PPC kernel image memory:
IOS_MCP:0503406A ; address == 0x08000000
IOS_MCP:0503406A ; size == 0x00120000
IOS_MCP:0503406A ; ->0 on success
IOS_MCP:0503406A ;
IOS_MCP:0503406E MOVS R4, R0 ; Rd = Op2
IOS_MCP:05034070 CMP R0, #0 ; Set cond. codes on Op1 - Op2
IOS_MCP:05034072 BEQ loc_5034076 ; Branch
IOS_MCP:05034074 B Set_Error_Msg ; Branch
IOS_MCP:05034076
IOS_MCP:05034076 loc_5034076 ; CODE XREF: sub_5033C50+422j
IOS_MCP:05034076 LDR R1, =0x16FFFFC ; Load from Memory
IOS_MCP:05034078 STR R0, [R1] ; Store to Memory
IOS_MCP:0503407A MOVS R0, R1 ; Rd = Op2
IOS_MCP:0503407C MOVS R1, #4 ; Rd = Op2
IOS_MCP:0503407E BL Call_SysCall_0x52 ; void IOS_FlushDCache(void *ptr, unsigned int len)
IOS_MCP:0503407E ; Flush data cache
IOS_MCP:0503407E ; -> Nothing
IOS_MCP:05034082 LDR R2, =byte_193 ; Load from Memory
IOS_MCP:05034084 MOVS R3, #2 ; Rd = Op2
IOS_MCP:05034086 ADDS R6, R7, R2 ; Rd = Op1 + Op2
IOS_MCP:05034088 STRB R3, [R6] ; Store to Memory
IOS_MCP:0503408A LDR R4, =aExe ; "Exe"
IOS_MCP:0503408C LDR R3, =aPpc ; "PPC"
IOS_MCP:0503408E MOVS R2, R4 ; Rd = Op2
IOS_MCP:05034090 STR R3, [R7,#0x194+var_188] ; Store to Memory
IOS_MCP:05034092 MOVS R0, R3 ; Rd = Op2
IOS_MCP:05034094 MOVS R1, #0 ; Rd = Op2
IOS_MCP:05034096 MOVS R3, #1 ; Rd = Op2
IOS_MCP:05034098 STR R4, [R7,#0x194+var_18C] ; Store to Memory
IOS_MCP:0503409A STR R6, [SP,#0x19C+var_19C] ; Store to Memory
IOS_MCP:0503409C BL sub_5059570 ; Branch with Link
IOS_MCP:050340A0 BL init_mem1_ppc ; SysCall_0x5F
IOS_MCP:050340A0 ; int init_mem1_ppc()
IOS_MCP:050340A0 ; Fills range 0x00000000 to 0x00002000 in MEM1 with empty PPC branches
IOS_MCP:050340A0 ; -> Always 0
IOS_MCP:050340A0 ;
IOS_MCP:050340A4 MOVS R0, #0x180
IOS_MCP:050340A8 MOVS R5, #0 ; Rd = Op2
IOS_MCP:050340AA MOVS R4, #0 ; Rd = Op2
IOS_MCP:050340AC ADDS R0, R0, R7 ; Rd = Op1 + Op2
IOS_MCP:050340AE STR R4, [R0] ; Store to Memory
IOS_MCP:050340B0 STR R5, [R0,#4] ; Store to Memory
IOS_MCP:050340B2 BL IOS_GetUpTime64 ; int IOS_GetUpTime64(u64 *out_buf)
IOS_MCP:050340B2 ; Returns the current time in wide format
IOS_MCP:050340B2 ; -> 0 on success
IOS_MCP:050340B2 ;
IOS_MCP:050340B6 CMP R0, #0 ; Set cond. codes on Op1 - Op2
IOS_MCP:050340B8 BGE loc_50340C4 ; Branch
IOS_MCP:050340BA MOVS R2, #0x180
IOS_MCP:050340BE ADDS R2, R2, R7 ; Rd = Op1 + Op2
IOS_MCP:050340C0 STR R4, [R2] ; Store to Memory
IOS_MCP:050340C2 STR R5, [R2,#4] ; Store to Memory
IOS_MCP:050340C4
IOS_MCP:050340C4 loc_50340C4 ; CODE XREF: sub_5033C50+468j
IOS_MCP:050340C4 MOVS R4, #0xC2 ; Rd = Op2
IOS_MCP:050340C6 LDR R5, [R7,#0x194+var_184] ; Load from Memory
IOS_MCP:050340C8 LSLS R4, R4, #1 ; Logical Shift Left
IOS_MCP:050340CA LDR R3, [R4,R7] ; Load from Memory
IOS_MCP:050340CC STR R3, [R5,#0x14] ; Store to Memory
IOS_MCP:050340CE LDR R2, =byte_40C ; Load from Memory
IOS_MCP:050340D0 MOVS R1, R5 ; Rd = Op2
IOS_MCP:050340D2 LDR R0, =0x1FFF000 ; Load from Memory
IOS_MCP:050340D4 BL sub_5059018 ; Branch with Link
IOS_MCP:050340D8 LDR R0, =0x1FFF000 ; Load from Memory
IOS_MCP:050340DA LDR R1, =byte_40C ; Load from Memory
IOS_MCP:050340DC BL Call_SysCall_0x52 ; void IOS_FlushDCache(void *ptr, unsigned int len)
IOS_MCP:050340DC ; Flush data cache
IOS_MCP:050340DC ; -> Nothing
IOS_MCP:050340E0 MOVS R0, #1 ; Rd = Op2
IOS_MCP:050340E2 STRB R0, [R6] ; Store to Memory
IOS_MCP:050340E4 LDR R0, [R7,#0x194+var_188] ; Load from Memory
IOS_MCP:050340E6 MOVS R1, #0 ; Rd = Op2
IOS_MCP:050340E8 LDR R2, [R7,#0x194+var_18C] ; Load from Memory
IOS_MCP:050340EA MOVS R3, #1 ; Rd = Op2
IOS_MCP:050340EC STR R6, [SP,#0x19C+var_19C] ; Store to Memory
IOS_MCP:050340EE BL sub_5059570 ; Branch with Link
IOS_MCP:050340F2 MOVS R4, R0 ; Rd = Op2
IOS_MCP:050340F4 CMP R0, #0 ; Set cond. codes on Op1 - Op2
IOS_MCP:050340F6 BEQ loc_5034118 ; Branch
IOS_MCP:050340F8 MOVS R1, #4 ; Rd = Op2
IOS_MCP:050340FA LDR R0, =0x16FFFFC ; Load from Memory
IOS_MCP:050340FC BL IOS_InvalidateDCache ; void IOS_InvalidateDCache(void *ptr, unsigned int len)
IOS_MCP:050340FC ; Invalidate data cache
IOS_MCP:050340FC ; -> Nothing
IOS_MCP:050340FC ;
IOS_MCP:05034100 LDR R0, =aMcpPpcBootFail ; "MCP: PPC Boot FAIL.\n"
IOS_MCP:05034102 BL sub_5059140 ; Branch with Link
IOS_MCP:05034106 LDR R1, =0x16FFFFC ; Load from Memory
IOS_MCP:05034108 LDR R0, =aPpcBootErrorDR ; "PPC boot error %d, rom trace code %x\n"
IOS_MCP:0503410A LDRB R2, [R1] ; Load from Memory
IOS_MCP:0503410C MOVS R1, R4 ; Rd = Op2
IOS_MCP:0503410E BL sub_5059140 ; Branch with Link
IOS_MCP:05034112 BL sub_5059278 ; Branch with Link
IOS_MCP:05034116 B Set_Error_Msg ; Branch
IOS_MCP:05034118
IOS_MCP:05034118 loc_5034118 ; CODE XREF: sub_5033C50+4A6j
IOS_MCP:05034118 BL flush_ipc_server ; int flush_ipc_server()
IOS_MCP:05034118 ; Resets the ARM IPC control register's flags
IOS_MCP:05034118 ; -> 0 on success
IOS_MCP:05034118 ;
IOS_MCP:0503411C BL sub_5028700 ; Branch with Link
IOS_MCP:05034120 B Set_Error_Msg ; Branch.
Similar threads
-
-
-
-
-
-
-
@
The Real Jdbye:
@SylverReZ if you could find a v5 DS ML you would have the best of both worlds since the v5 units had the same backlight brightness levels as the DS Lite unlockable with flashme -
-
-
@
BigOnYa:
A woman with no arms and no legs was sitting on a beach. A man comes along and the woman says, "I've never been hugged before." So the man feels bad and hugs her. She says "Well i've also never been kissed before." So he gives her a kiss on the cheek. She says "Well I've also never been fucked before." So the man picks her up, and throws her in the ocean and says "Now you're fucked."+2 -
-
-
@
BakerMan:
anyways, we need to re-normalize physical media+1
if i didn't want my games to be permanent, then i'd rent them -
@
BigOnYa:
Agreed, that why I try to buy all my games on disc, Xbox anyways. Switch games (which I pirate tbh) don't matter much, I stay offline 24/7 anyways.
-
-
@
cearp:
@BakerMan - you can still "own" digital media, arguably easier and better than physical since you can make copies and backups, as much as you like.+1
The issue is DRM -
@
cearp:
You can buy drm free games / music / ebooks, and if you keep backups of your data (like documents and family photos etc), then you shouldn't lose the game. but with a disk, your toddler could put it in the toaster and there goes your $60
-
-
@
rqkaiju2:
i like physical media because it actually feels like you own it. thats why i plan on burning music to cds -
-
-
@
SylverReZ:
@rqkaiju2, Physical media is a great source for archiving your data, none of that cloud storage shiz.+1 -
-
-
. Saves on time, soap, water and money having to wash them.