maybe I'd be better at getting back into my reverse engineering projects if getting back into them didn't involve first figuring out which of the 13 Ghidra versions I have installed is for that project
Conversation
Notices
-
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 09:21:12 JST Foone🏳️⚧️ -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 09:22:43 JST Foone🏳️⚧️ okay it's not 10.1-beta, because that one was used to hack on Spyro for the GBA, Excel '95, the Tandy-Memorex VIS BIOS, and the FlashPath kernel driver
-
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 09:24:04 JST Foone🏳️⚧️ 10.1 non-beta was Railroad Tycoon and "MyPetChimp", whatever that was.
-
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 09:25:50 JST Foone🏳️⚧️ 10.1.5 was the DS9 point and click game and a WinCE powered printer
-
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 09:27:25 JST Foone🏳️⚧️ 10.1.4 was an aliexpress single-key-keyboard and some parts of the Borland Graphics Interface
-
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 09:30:06 JST Foone🏳️⚧️ 10.0.4 was SOLELY for a GBA DBZ game
-
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 09:31:16 JST Foone🏳️⚧️ 9.2.2 was a vape unit I was trying to run Doom on, Duke Nukem 1 for DOS, and Links386 for DOS
-
William D. Jones (cr1901@mastodon.social)'s status on Sunday, 01-Sep-2024 09:33:21 JST William D. Jones @foone There's no upgrade path for projects? ._.
(Was thinking of getting back into Ghidra for non-DPMI, non-8088 stuff...)
-
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 09:33:21 JST Foone🏳️⚧️ @cr1901 There is, but the extensions (for console CPUs and such) are tied to the exact version, so often I've got version X, but then I need to disassemble a new CPU, but the extension to do that is only available for version Y
-
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 09:34:54 JST Foone🏳️⚧️ @cr1901 and I could PRESUMABLY manually build new extension versions myself from source, but frankly that's too much of a mess for me to bother when I can just install a separate version of ghidra
-
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 09:35:58 JST Foone🏳️⚧️ @cr1901 until I end up with 13 versions installed and it's now a disaster
-
<?xml version="2.0"?> (overanalytcl@hachyderm.io)'s status on Sunday, 01-Sep-2024 09:39:27 JST <?xml version="2.0"?> @foone *why* do you have 13 versions?
-
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 09:39:27 JST Foone🏳️⚧️ @overanalytcl I explain here:
https://digipres.club/@foone/113059464273865702 -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 09:41:29 JST Foone🏳️⚧️ ah-ha! It was 10.2.2
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 09:48:54 JST Foone🏳️⚧️ @nex yeah I've played it on DOS computers! that's relatively normal, if just anachronistic
In conversation permalink -
nex (nex@fedi.transgender.ing)'s status on Sunday, 01-Sep-2024 09:49:07 JST nex @foone@digipres.club Have you ever played doom on a normal device? do you even own a normal device? do you post from a smart cooker or something? That seems in character for you
In conversation permalink -
William D. Jones (cr1901@mastodon.social)'s status on Sunday, 01-Sep-2024 09:50:20 JST William D. Jones @foone Good to know your user experience so that I may adjust mine accordingly. Are extensions written in Java? Maybe I'll install a toolchain so I can compile extensions from source if I have to.
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 09:50:20 JST Foone🏳️⚧️ @cr1901 yeah, they're java.
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 09:55:39 JST Foone🏳️⚧️ okay now I can see why may2023!foone got stuck here. this is so fucking complicated.
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 09:58:17 JST Foone🏳️⚧️ I'm trying to decode a scripting language for a video game, but the problem it's not just a bytecode file, it's more like an EXE file. It's got multiple sorts of metadata that has to be properly parsed, and linking that needs to be done, and that task is proving to be a little too hard for my tiny brain
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 10:00:22 JST Foone🏳️⚧️ especially because it's doing this kind of... in-place relocation thing?
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 10:05:50 JST Foone🏳️⚧️ like the bytecode will be:
pvm_Call 0, 0
and then the relocations will kick in and that'll turn into:
pvm_Call Vanna.revealTile
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 10:07:52 JST Foone🏳️⚧️ @overanalytcl @cr1901 Yes. unless you also had an extension that only worked on version X
In conversation permalink -
<?xml version="2.0"?> (overanalytcl@hachyderm.io)'s status on Sunday, 01-Sep-2024 10:07:53 JST <?xml version="2.0"?> @foone @cr1901 but doesn't that mean that with version Y you can also disassemble everything you could with version X?
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 10:12:12 JST Foone🏳️⚧️ but because this is all done in an in-place loading style, it's really a pain to understand, so I've not yet been able to write a disassembler
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 10:13:24 JST Foone🏳️⚧️ it's also a typed VM, so that makes it even more complicated. (Because the types are stored in the executable metadata)
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 10:16:26 JST Foone🏳️⚧️ @gsuberland yeah, but the weird thing is that .net is a whole professional programming language thing, and this is a scripting language for a Wii game
In conversation permalink -
Graham Sutherland / Polynomial (gsuberland@chaos.social)'s status on Sunday, 01-Sep-2024 10:16:27 JST Graham Sutherland / Polynomial @foone heh, this sounds like .NET
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 10:25:30 JST Foone🏳️⚧️ huh. this game has a "SILENCE LOADING ERRORS" flag. there's no way to turn it on, so loading errors will always be reported.
normally games have a verbose/debug flag that devs turn on, not a "be quiet" flag that never gets turned on
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 10:26:50 JST Foone🏳️⚧️ @gsuberland Nope. All I can tell is that it's in-house, but they seem to have used it across several games
In conversation permalink -
Graham Sutherland / Polynomial (gsuberland@chaos.social)'s status on Sunday, 01-Sep-2024 10:26:51 JST Graham Sutherland / Polynomial @foone yeah, certainly seems like they put a ton of effort into it. any evidence that it might be a licensed library?
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 10:30:08 JST Foone🏳️⚧️ oh god. I thought I'd fill out the resolveTypes function of module loading but it turns out it's a five-pass loader that loads data in place
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 10:52:41 JST Foone🏳️⚧️ oh god
if( fixup_passes>=64 ){
btype_failure = true;
}In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 10:55:39 JST Foone🏳️⚧️ SIXTY FOUR FUCKING FIXUP PASSES?
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 11:22:29 JST Foone🏳️⚧️ I think these guys wrote their scripting language so that array types have a declared length, but then neglected to actually tell the script executor about that. it doesn't seem to save that information anywhere or compare it to anything
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 11:24:30 JST Foone🏳️⚧️ the worst thing about this particular scripting language is that it's compiled to bytecode, but they also have a debug file that includes all the information removed by byte-compiling. So I have variable names and comments and such, right?
but it's in a separate binary format that I can't load. So it's tempting but also useless
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 11:44:00 JST Foone🏳️⚧️ WFCommonJunction::getProfileGender
MY GENDER IS BETWEEN ME AND GOD, YOU CANNOT KNOW IT, GAME FOR THE NINTENDO WII
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 11:46:38 JST Foone🏳️⚧️ this game has been out for 14 years and no one has figured out the cheat codes for it.
but I am dangerously close.
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 11:51:16 JST Foone🏳️⚧️ @clayote and I keep my gender on a floppy disk!
wait. shit. oh no... this explains a lot.
In conversation permalink Attachments
-
clayote (clayote@peoplemaking.games)'s status on Sunday, 01-Sep-2024 11:51:17 JST clayote @foone The relation between gender and a floppy disk is between gender and that floppy disk.
In conversation permalink Foone🏳️⚧️ repeated this. -
Dave Murphy (he/him) (davejmurphy@disabled.social)'s status on Sunday, 01-Sep-2024 12:02:45 JST Dave Murphy (he/him) @foone lol nvm. I finally read to the relevant parts of the thread. https://digipres.club/@foone/113059464273865702
Begs the question why newer versions of ghidra can't load extensions for old versions. Is there some kind of ABI breakage going on? An issue with java?
In conversation permalink Attachments
-
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 12:02:45 JST Foone🏳️⚧️ @davejmurphy Ghidra just refuses to load incorrect-version extensions, even if they would work. So you'd have to set up the java environment to compile your own, which I've not bothered with
In conversation permalink -
Dave Murphy (he/him) (davejmurphy@disabled.social)'s status on Sunday, 01-Sep-2024 12:02:46 JST Dave Murphy (he/him) @foone why are all these ghidra versions not interchangeable?
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 12:06:52 JST Foone🏳️⚧️ I think I officially did too much Rust programming. I'm back on my home turf of python(2), and I'm missing the match expression
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 12:24:38 JST Foone🏳️⚧️ @clayote probably should do that yeah.
In conversation permalink -
clayote (clayote@peoplemaking.games)'s status on Sunday, 01-Sep-2024 12:24:39 JST clayote @foone Just switch to Python 3.10 or later? Which has a match expression? https://peps.python.org/pep-0635/
In conversation permalink Attachments
-
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 12:31:09 JST Foone🏳️⚧️ okay it kind of does relocation backwards.
my understanding is that the way this is done on sensible platforms is that there's an executable that's like "hey, when you load me, shove the pointer to GetWindowTextA at offset 0x234805 in my code"In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 12:32:43 JST Foone🏳️⚧️ this instead steps through the entire code looking for specific bytecode opcodes that it knows need relocation.
so when it sees a pvm_Jump opcode, it knows that although that opcode takes an absolute address, it interprets the current "absolute address" as an index into a jump table, which it then overwrites the current value with.
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 12:46:54 JST Foone🏳️⚧️ I'd love to do more logging on what the game is actually doing at runtime, but it turns out this interpreter is multithreaded. It's running tons of scripts at the same time, and it's really a pain to track which execution is for which script
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 12:49:08 JST Foone🏳️⚧️ plus the debug logging capabilities of the emulator are abysmal
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 12:57:58 JST Foone🏳️⚧️ oh god
please tell me you fools didn't design a bytecode VM with DELAY SLOTS
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 13:07:52 JST Foone🏳️⚧️ ahh, it uses a 24bit addressing scheme. nice.
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 13:09:06 JST Foone🏳️⚧️ or rather, it's an encoding scheme where they tag their pointers. and if the upper byte of a 32bit pointer is 1 or 0, it gets relocated.
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 13:13:16 JST Foone🏳️⚧️ so this resolveRefs function iterates through all the code and it sometimes sets a local boolean
it never, ever, reads it. WHY IS THIS HERE?
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 13:14:58 JST Foone🏳️⚧️ so, this specific bytecode looks like this:
pvm_PushConstant 0
and you might think that just pushes a zero onto the stack. Nope! it instead looks up constant #0, which according to the table for this file, is... 0. oh.
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 13:47:01 JST Foone🏳️⚧️ for (iVar2 = 0; iVar2 < (int)(uint)*(ushort *)(((uint)((PVOpCode *)pdata + 4) & 0xfffffffc) + 2); iVar2 = iVar2 + 1) {
is that enough casts, ghidra?
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 13:49:35 JST Foone🏳️⚧️ You know you've got a great decompiler when it's way easier to figure out WTF the pointers are doing by just reading the powerpc disassembly
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 14:05:24 JST Foone🏳️⚧️ okay I got most of the relocation step finished. I haven't managed the switch statement (IT'S COMPLICATED AND INVOLVES POINTERS) and the EnterFrame statement, because I'm not really sure what the fuck it's doing.
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 01-Sep-2024 22:40:49 JST Foone🏳️⚧️ @petrapup yes
In conversation permalink -
PetraPUP (petrapup@mastodon.triggerphra.se)'s status on Sunday, 01-Sep-2024 22:40:50 JST PetraPUP @foone is this. is this wheel of fortune
In conversation permalink -
Misty (misty@digipres.club)'s status on Sunday, 01-Sep-2024 23:31:33 JST Misty @foone Reminds me of a game I was looking at which used a virtual filesystem with a sidecar file containing the filenames…on one platform. They didn’t ship it on the other platform and the file sizes/orders didn’t line up.
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 00:02:51 JST Foone🏳️⚧️ @misty yikes.
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 04:15:39 JST Foone🏳️⚧️ @f00fc7c8 and some people!
In conversation permalink -
F00F the elusive (f00fc7c8@woem.space)'s status on Monday, 02-Sep-2024 04:16:43 JST F00F the elusive @foone apparently glitch genders are a thing in some games
In conversation permalink -
Joseph E (blackboxre@infosec.exchange)'s status on Monday, 02-Sep-2024 04:17:49 JST Joseph E @foone lol, I don’t use Ghidra much for a variety of reasons but a friend once sent me this tip about turning off type casting: Tool Options -> Decompiler -> Display -> Disable Printing of Type Casts
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 04:17:49 JST Foone🏳️⚧️ @blackBoxRE oooooh
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 11:24:33 JST Foone🏳️⚧️ the fixup of the switchtable is unrolled.
now, I'm looking at disassembly, so that could be the compiler, but... here's the thing: I haven't seen any unrolled loops anywhere.
I think they manually unrolled this shit.
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 11:38:07 JST Foone🏳️⚧️ I can't figure out whatever this shit is doing.
In conversation permalink Attachments
-
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 11:40:53 JST Foone🏳️⚧️ pdata points to the beginning of the instruction, which looks like this:
6E 7F 7F 7F 00 0C 00 00so pdata[0] is the pvm_EnterFrame, which is 6E. the 7Fs are a placeholder. So this frameptr is getting pointed at the first 00.
Then that check in the middle of the for() loop is looking at the same location but plus 2, so the 00 00?
so this loop in this case... doesn't run at all. Huh.
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 11:43:20 JST Foone🏳️⚧️ but the next time it gets called, it's:
6E 7F 7F 00 44 00 04 02 00 00 00 00 00 00
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 11:44:49 JST Foone🏳️⚧️ ugh I think the thing that's weird here is the &0xfffffffc
It's doing alignment, adjusting pointers to only be on 4s
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 11:47:59 JST Foone🏳️⚧️ and that first bit of code is at 0x70, which is a multiple of 4, so 0x70+4 just equals 0x74.
but the second time, it's at 0x79!
so 0x79+4 is is 0x7D: but that turns into 0x7C when we apply the AND.In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 11:49:32 JST Foone🏳️⚧️ so this is a bytecode that has variable padding in order to align to 4 bytes. ugh.
In conversation permalink -
nick (nickzoic@aus.social)'s status on Monday, 02-Sep-2024 11:53:07 JST nick @foone is it using useless_boolean to check if the loop is run at all?
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 11:53:07 JST Foone🏳️⚧️ @nickzoic useless_boolean is never checked at any point
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 11:58:40 JST Foone🏳️⚧️ oh, I think I've got what EnterFrame is: It's a way to easily shove multiple typed variables onto the stack, so the function/script can use them.
and it's doing a fixup to know what the types are, since they're declared in the relocation header
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 12:00:37 JST Foone🏳️⚧️ yeah, it ends up looking like:
pvm_EnterFrame int, int, bool, GuiAnim
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 12:04:47 JST Foone🏳️⚧️ okay now I have a disassembler that can only disassemble the relocatable instructions (and can't fully do one of them, because it's complicated)
I now need to add the ones that don't relocate, which is a separate headache
In conversation permalink -
Ron Gilbert #KamalaHarris (grumpygamer@mastodon.gamedev.place)'s status on Monday, 02-Sep-2024 12:06:18 JST Ron Gilbert #KamalaHarris In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 12:06:59 JST Foone🏳️⚧️ @grumpygamer @nickzoic it sure should, but since I'm looking at disassembly here... it didn't!
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 12:15:42 JST Foone🏳️⚧️ ugh. apparently EnterFrame also adds a frame pointer (somewhere) and then the pvm_PushLocal operates off it.
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 12:16:44 JST Foone🏳️⚧️ Food $200
Data $150
Rent $800
Stacks $3,600
Utility $150
someone who is good at interpreters please help me budget this. my scripting language is dyingIn conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 12:39:21 JST Foone🏳️⚧️ @0xSim no
In conversation permalink -
Sim (0xsim@hachyderm.io)'s status on Monday, 02-Sep-2024 12:39:22 JST Sim @foone reduce your stacks usage
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 12:44:33 JST Foone🏳️⚧️ anyway I'm now at the point where I've written enough of a disassembler that I need to basically throw it away and make this thing better and more systematic, so I can eventually have it give me real source files (not log output) and even further on, so I can round-trip it and re-compile these scripts
In conversation permalink -
Rue Mohr (ruenahcmohr@infosec.exchange)'s status on Monday, 02-Sep-2024 12:49:14 JST Rue Mohr @foone useless_boolean will detect if the for loop never ran at all, because of the stop requirement.
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 12:49:14 JST Foone🏳️⚧️ @RueNahcMohr useless_boolean is actually never read by any code. thus the "useless"
In conversation permalink -
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Sep-2024 12:57:21 JST Foone🏳️⚧️ @RueNahcMohr yeah! and apparently their compiler didn't warn them about this. or they didn't care
In conversation permalink -
Rue Mohr (ruenahcmohr@infosec.exchange)'s status on Monday, 02-Sep-2024 12:57:22 JST Rue Mohr @foone .....huh, ok, maybe the author didn't turn out to actually need it in the end???
In conversation permalink
-