NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
50.57k stars 5.78k forks source link

[PowerPC] Ghidra decompiler doesn't understand non-r2 SDA #325

Closed NWPlayer123 closed 5 years ago

NWPlayer123 commented 5 years ago

Context: GameCube and Wii are compiled with two Small Data Area/Table Of Contents (SDA/TOC) registers, that it reserves for single-instruction data manipulation, r2 and r13. Right now it looks like it only understands r2. Whenever it hits r13, it sets a variable and then manually shows the (r13 - 0x____) as a variable, instead of knowing that there's a variable there, which gives really terrible decompilation results.

Screenshot_444

tmbinc commented 5 years ago

Some PowerPC code I've seen even uses r2,r13,r14,r15,r16 (GM E98 ECU; not sure which compiler this is).

caheckman commented 5 years ago

Just looking at the screenshot, it looks like r13 may be getting treated as a save register, which I think is a non-standard ABI. You could try adding r13 to the unaffected list in the cspec to see if this helps decompilation. Its hard to tell from the screenshot, but I'm assuming you're using ppc_32_be.cspec. Look for the lines:

  <unaffected>
    <register name="r14"/>
    <register name="r15"/>
    <register name="r16"/>
    <register name="r17"/>

Add a " line, then save and restart.

You also might want to investigate turning on in-lining or applying a call-fixup for the _savegpr_26 function. It looks suspiciously like an internal compiler function.

NWPlayer123 commented 5 years ago

@caheckman yeah, 1) GameCube/Wii are big endian aka PPC32BE 2) restgpr and savegpr are part of the Metrowerks/CodeWarrior EABI w/e, I just didn't bother fixing the def and inlining for the screenshot 3) I'll try that and report back. I haven't figured out how to refresh decomp but I'll take your word that it just needs a restart

NWPlayer123 commented 5 years ago

@caheckman it works, papa bless Screenshot_450 Screenshot_451

derek57 commented 5 years ago

@NWPlayer123:

I came across this a few days ago:

https://github.com/aldelaro5/ghidra-gekko-broadway-lang

Would you mind creating a pull request which the guy maintaining this plugin could add there in order to make decompilation of the Broadway / Gekko stuff even better? I mean also this stuff you described here. I came across this as well upon decompilation of the debugger kernel which was a royal pain in the a**...

Thanks in advance.

aldelaro5 commented 5 years ago

@NWPlayer123:

I came across this a few days ago:

https://github.com/aldelaro5/ghidra-gekko-broadway-lang

Would you mind creating a pull request which the guy maintaining this plugin could add there in order to make decompilation of the Broadway / Gekko stuff even better? I mean also this stuff you described here. I came across this as well upon decompilation of the debugger kernel which was a royal pain in the a**...

Thanks in advance.

It's already been fixed 20 days ago: https://github.com/aldelaro5/ghidra-gekko-broadway-lang/commit/d4a57a619f3659d0fc302f5478bc06042fb69dba

RenaKunisaki commented 4 years ago

Am I doing something wrong? It still doesn't seem to recognize labels relative to r13.

derek57 commented 4 years ago

Am I doing something wrong? It still doesn't seem to recognize labels relative to r13.

I'm also still having the same issue as you.

NWPlayer123 commented 4 years ago

Did you actually set r2/r13? @derek57 @RenaKunisaki You need to actually set it, and then modify the address range to the whole thing, maybe a re-analyze, and then it should work. If you're doing GameCube/Wii, https://github.com/Cuyler36/Ghidra-GameCube-Loader will auto-find the values for you with a custom analysis option.

![Screenshot_466](https://user-images.githubusercontent.com/3280345/70752676-5743a080-1cf0-11ea-9205-c82657f74329.png) ![Screenshot_467](https://user-images.githubusercontent.com/3280345/70752678-5743a080-1cf0-11ea-82b1-81a2a091d42a.png) ![Screenshot_468](https://user-images.githubusercontent.com/3280345/70752677-5743a080-1cf0-11ea-9b77-2cc535cdf2ff.png) ![Screenshot_469](https://user-images.githubusercontent.com/3280345/70752776-8823d580-1cf0-11ea-9ea0-cbbc8e2d4ffb.png)
RenaKunisaki commented 4 years ago

I did get it, but I'm really not sure how. It felt like it just decided to work.

derek57 commented 4 years ago

Well, I finally got it done - thx to @NWPlayer123.

Isn't it possible to directly implement this into @aldelaro5's Ghidra Gekko repo at https://github.com/aldelaro5/ghidra-gekko-broadway-lang/ ?