Getting symbols from arbitrary RPLs?

Discussion in 'Wii U - Hacking & Backup Loaders' started by BullyWiiPlaza, Aug 15, 2016.

  1. BullyWiiPlaza
    OP

    BullyWiiPlaza Nintendo Hacking <3

    Member
    1,727
    1,409
    Aug 2, 2014
    Germany
    I tried to get the function addresses from functions defined outside of coreinit.rpl (e.g. in a game's RPL) but getting their addresses does not work with the "usual way". It keeps returning an invalid address. Is there something I'm doing wrong or is it currently not possible?

    JGecko U code snippet:
    Code:
    Connector.getInstance().connect("192.168.178.35");
            RemoteProcedureCall remoteProcedureCall = new RemoteProcedureCall();
            ExportedSymbol exportedSymbol = remoteProcedureCall.getSymbol("some-game.rpl",
                    "some-function-from-it");
            System.out.println(new Hexadecimal(exportedSymbol.getAddress(), 8)); // Prints: 0023493C (which is invalid)
            Connector.getInstance().closeConnection();
    It works fine with coreinit.rpl functions though:
    Code:
    Connector.getInstance().connect("192.168.178.35");
    RemoteProcedureCall remoteProcedureCall = new RemoteProcedureCall();
    ExportedSymbol exportedSymbol = remoteProcedureCall.getSymbol("coreinit.rpl",
        "OSGetSystemTime");
    System.out.println(new Hexadecimal(exportedSymbol.getAddress(), 8)); // Prints: 0104337C (which is correct)
    Connector.getInstance().closeConnection();
    Thank you :)
     
    Last edited by BullyWiiPlaza, Aug 15, 2016
    fraret likes this.
  2. NexoCube

    NexoCube stop using piracy :(

    Member
    1,184
    587
    Nov 3, 2015
    France
    Stack Pointer
    sneaky sneaky

    Are trying to get the function adresses while you are in the game (I think here, you are trying to get black ops 2 mp rpl), be sure you are in the multiplayer menu, if it doesn't work try to find some rpl/rpx related function in coreinit ;)
     
    BullyWiiPlaza likes this.
  3. shinyquagsire23

    shinyquagsire23 SALT/Sm4sh Leak Guy

    Member
    1,962
    3,231
    Nov 18, 2012
    United States
    Las Vegas
    RPLs and RPXs are relocated at runtime, as long as the result isn't negative it should be valid.
     
    BullyWiiPlaza and NexoCube like this.
  4. NexoCube

    NexoCube stop using piracy :(

    Member
    1,184
    587
    Nov 3, 2015
    France
    Stack Pointer
    Yeah i think they are set in RAM (Random Access Memory) at runtime but i'm not sure
     
  5. BullyWiiPlaza
    OP

    BullyWiiPlaza Nintendo Hacking <3

    Member
    1,727
    1,409
    Aug 2, 2014
    Germany
    How to use the result then? 2 different functions both had the same address returned which is invalid, sorry...
     
  6. NWPlayer123

    NWPlayer123 GBAtemp Addict

    Member
    2,629
    6,226
    Feb 17, 2012
    United States
    The Everfree Forest
    That means you probably need to pass isData as 1
     
    BullyWiiPlaza likes this.
  7. BullyWiiPlaza
    OP

    BullyWiiPlaza Nintendo Hacking <3

    Member
    1,727
    1,409
    Aug 2, 2014
    Germany
    That indeed produces a valid address now but it doesn't look right in memory: 0123493C
    Again two different functions produce the same result. :(
     
    Last edited by BullyWiiPlaza, Aug 16, 2016
  8. NWPlayer123

    NWPlayer123 GBAtemp Addict

    Member
    2,629
    6,226
    Feb 17, 2012
    United States
    The Everfree Forest
    it is, 01 is where all the libraries are in virtual, 0x01000000 to whatever, 0x01800000 in the browser ending at JIT, is that chunk for all system RPLs
     
  9. BullyWiiPlaza
    OP

    BullyWiiPlaza Nintendo Hacking <3

    Member
    1,727
    1,409
    Aug 2, 2014
    Germany
    But I checked in the disassembler and it's not right
     
  10. BullyWiiPlaza
    OP

    BullyWiiPlaza Nintendo Hacking <3

    Member
    1,727
    1,409
    Aug 2, 2014
    Germany
    Getting the symbol does NOT work. However, if you find the function address manually you can indeed call it using the RPC system. The offset between in-memory function addresses and the ones in IDA is constant :)
     
    Last edited by BullyWiiPlaza, Aug 25, 2016