search

Maschell / GhidraRPXLoader

GNU General Public License v3.0
59 stars 21 forks source link

Lego Games RPX not loading properly #2

Open bloodmc opened 5 years ago

bloodmc commented 5 years ago

On Ghidra 9.0.2, the following errors occur when attempting to open the Lego Dimensions RPX

https://gist.githubusercontent.com/bloodmc/a116141e7486d7fca8a738c02ee43b4e/raw/78f5d6aa00ee5fc93908a327298a80f8db9c37a0/ghidra_lego_rpx.txt

This causes all code to show up with ??.

From what I was told, Lego Dimensions uses some odd wrappers causing various RPX loaders to not work fully.

bloodmc commented 5 years ago

@Maschell Any idea on this issue? If you need more information let me know.

Thanks!

Dug a bit further, the error's are coming from Ghidra's ELF loader.

https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/ElfProgramBuilder.java#L704

https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/ElfProgramBuilder.java#L1273

bloodmc commented 5 years ago

@NWPlayer123 Sorry to ping you here but I see you have dealt with various ELF/RPL/RPX tools on your github and was wondering if you would be able to chime in on the above issue?

Maschell commented 5 years ago

Do you have a hash of the RPX you were using?

bloodmc commented 5 years ago

I'm using the latest Lego Dimensions update (v320) RPX. 

File: zeus.master.rpx
CRC-32: 0465374c
   MD4: fbb209c297f547c46ef7b68f92e1f90e
   MD5: fcf2e16280c8fea7b27ac7201108dcf9
 SHA-1: 1a9ef44c44e6b0769674180920a795efdcf4521e
bloodmc commented 5 years ago

Update: If I decompress the RPX file, it partially works. Here are the steps I used

  1. Download wiiurpxtool from https://github.com/0CBH0/wiiurpxtool/releases
  2. Execute the following command wiiurpxtool -d zeus.master.rpx zeus.decompressed.rpx
  3. Import zeus.decompressed.rpx into Ghidra and it partially works. Note: This mostly works but I get many Bad instruction: Unable to resolve constructor at addr errors. This causes sections with errors to show up as ??