search

Adubbz / Ghidra-Switch-Loader

Nintendo Switch loader for Ghidra
ISC License
278 stars 41 forks source link

NSO Loader: Index 0 out of bounds for length 0 #41

Closed DavidBuchanan314 closed 10 months ago

DavidBuchanan314 commented 1 year ago 
Index 0 out of bounds for length 0
java.lang.IndexOutOfBoundsException: Index 0 out of bounds for length 0
    at java.base/jdk.internal.util.Preconditions.outOfBounds(Preconditions.java:64)
    at java.base/jdk.internal.util.Preconditions.outOfBoundsCheckIndex(Preconditions.java:70)
    at java.base/jdk.internal.util.Preconditions.checkIndex(Preconditions.java:266)
    at java.base/java.util.Objects.checkIndex(Objects.java:361)
    at java.base/java.util.ArrayList.get(ArrayList.java:427)
    at adubbz.nx.loader.common.NXProgramBuilder.setupRelocations(NXProgramBuilder.java:270)
    at adubbz.nx.loader.common.NXProgramBuilder.load(NXProgramBuilder.java:117)
    at adubbz.nx.loader.SwitchLoader.loadProgramInto(SwitchLoader.java:164)
    at ghidra.app.util.opinion.AbstractProgramLoader.loadInto(AbstractProgramLoader.java:171)
    at adubbz.nx.loader.SwitchLoader.loadProgram(SwitchLoader.java:117)
    at ghidra.app.util.opinion.AbstractProgramLoader.load(AbstractProgramLoader.java:132)
    at ghidra.plugin.importer.ImporterUtilities.importSingleFile(ImporterUtilities.java:388)
    at ghidra.plugin.importer.ImporterDialog.lambda$okCallback$7(ImporterDialog.java:347)
    at ghidra.util.task.TaskBuilder$TaskBuilderTask.run(TaskBuilder.java:306)
    at ghidra.util.task.Task.monitoredRun(Task.java:134)
    at ghidra.util.task.TaskRunner.lambda$startTaskThread$0(TaskRunner.java:106)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
    at java.base/java.lang.Thread.run(Thread.java:833)

---------------------------------------------------
Build Date: 2023-Apr-05 1559 BST
Ghidra Version: 10.3
Java Home: /usr/lib/jvm/java-17-openjdk
JVM Version: N/A 17.0.7
OS: Linux 6.3.0-asahi-8-1-edge-ARCH aarch64

Sorry for the vagueness, I'm down a rabbithole rn so I'll circle back and provide more details later

DavidBuchanan314 commented 1 year ago

Ok so the binary I was loading was the exefs main of 0100000000001010 (LibAppletLns), from fw version 16.0.3.

I commented out these three lines and was able to get the binary loaded:

https://github.com/Adubbz/Ghidra-Switch-Loader/blob/60e57360238d14c84cdd0c72fd70db59a65c3ecd/src/main/java/adubbz/nx/loader/common/NXProgramBuilder.java#L270-L272

Presumably, there were 0 plt entries, but the code assumes that there's always at least one. I suppose a proper solution would be to only create the .plt section if there's 1 or more plt entries? But maybe there's something more subtle going on here, and the plt entries just aren't being detected properly?

TSRBerry commented 1 year ago

Usually if there are no plt entries it should already abort here: https://github.com/Adubbz/Ghidra-Switch-Loader/blob/60e57360238d14c84cdd0c72fd70db59a65c3ecd/src/main/java/adubbz/nx/loader/common/NXProgramBuilder.java#L211-L215

The assumption that at least one entry exists after the while loop should probably still be removed. I'm curious what's happening here, I'll try to investigate that later (since that's a great excuse to actually learn more about the format).

TSRBerry commented 1 year ago

Okay actually I can't figure out much. I don't know enough about how ELF files are structured and how NSO files work.

The only hunch I have is that it might be related to the fact that the sdk binary is almost completely empty. But I think the more interesting bit might be that the IDA loader assumes the same thing: https://github.com/Atmosphere-NX/Atmosphere/blob/8b88351cb46afab3907e395f40733854fd8de0cf/utilities/nxo64.py#L420-L422

Since these sections in the Ghidra and the IDA plugin are almost identical, but neither of them are well documented, I'm not sure if this was done intentionally. I'd also like to know what all these magic numbers mean, but I feel like that's currently still too hard for me to figure out.