Hacking Getting symbols from arbitrary RPLs?

BullyWiiPlaza

Nintendo Hacking <3
OP
Member
Joined
Aug 2, 2014
Messages
1,932
Trophies
0
XP
2,477
Country
Germany
I tried to get the function addresses from functions defined outside of coreinit.rpl (e.g. in a game's RPL) but getting their addresses does not work with the "usual way". It keeps returning an invalid address. Is there something I'm doing wrong or is it currently not possible?

JGecko U code snippet:
Code:
Connector.getInstance().connect("192.168.178.35");
        RemoteProcedureCall remoteProcedureCall = new RemoteProcedureCall();
        ExportedSymbol exportedSymbol = remoteProcedureCall.getSymbol("some-game.rpl",
                "some-function-from-it");
        System.out.println(new Hexadecimal(exportedSymbol.getAddress(), 8)); // Prints: 0023493C (which is invalid)
        Connector.getInstance().closeConnection();
It works fine with coreinit.rpl functions though:
Code:
Connector.getInstance().connect("192.168.178.35");
RemoteProcedureCall remoteProcedureCall = new RemoteProcedureCall();
ExportedSymbol exportedSymbol = remoteProcedureCall.getSymbol("coreinit.rpl",
    "OSGetSystemTime");
System.out.println(new Hexadecimal(exportedSymbol.getAddress(), 8)); // Prints: 0104337C (which is correct)
Connector.getInstance().closeConnection();
Thank you :)
 
Last edited by BullyWiiPlaza,
  • Like
Reactions: fraret

NexoCube

Well-Known Member
Member
Joined
Nov 3, 2015
Messages
1,222
Trophies
0
Age
29
Location
France
XP
1,340
Country
France
sneaky sneaky

Are trying to get the function adresses while you are in the game (I think here, you are trying to get black ops 2 mp rpl), be sure you are in the multiplayer menu, if it doesn't work try to find some rpl/rpx related function in coreinit ;)
 
  • Like
Reactions: BullyWiiPlaza

BullyWiiPlaza

Nintendo Hacking <3
OP
Member
Joined
Aug 2, 2014
Messages
1,932
Trophies
0
XP
2,477
Country
Germany
Getting the symbol does NOT work. However, if you find the function address manually you can indeed call it using the RPC system. The offset between in-memory function addresses and the ones in IDA is constant :)
 
Last edited by BullyWiiPlaza,

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    AncientBoi @ AncientBoi: I'm not supporting Coke right now, as Africa is supporting russia with troops :creep: