search

lab313ru / ghidra_psx_ldr

Sony Playstation PSX executables loader for GHIDRA
231 stars 31 forks source link

Support "System Snapshot" file #29

Open asmblur opened 4 years ago

asmblur commented 4 years ago

Now, there's no file format that exists that I know of that quite describes this but emulators could definitely generate these. Basically a "System Configuration"(see other feature request) that has been made from a save state of an emulator. Basically coredump including RAM(0x0-0x001FFFFF/0x007FFFFF), ScratchPad(0x1F800000-0x3FF), BIOS(0xBFC00000-0x7FFFF(by default but can be up to 0x00400000 bytes in size), Expansion 1(0x1F000000-0x0007FFFF(by default but can be up to 0x00800000 bytes in size), Expansion 2(0x1F802000-0x7F though size may vary), Expansion 3(0x1FA00000-0x0007FFFF though ca be up to 0x00200000 bytes long). And hardware registers at 0x1F801000-1FFF.

lab313ru commented 3 years ago

So, what do you exactly want? To support format that even doesn't exist?

ItEndsWithTens commented 3 years ago

I'm not sure what end goal @asmblur originally had in mind, and I don't mean to hijack the discussion, but I've been wondering about something vaguely similar to this idea for a bit. I'm still new to Ghidra, reverse engineering in general, and the technical details of the Playstation in particular, so please pardon me if this is a stupid question: is there a way to apply your extension's analysis to files that aren't strictly PS-X executables?

I've been analyzing a game based on not just the actual PS-X EXE from the disc, but also binary dumps of main RAM from an emulator, to examine various snapshots of the game's state in detail and annotate them by way of labels and comments. I've had a good amount of success, but I feel like I'd be better able to understand the code if the full analysis could run directly on the files in question. Just having a psyq data type archive associated with my project seems to allow some degree of analysis to work, and I can of course use Ghidra's Diff Tool to copy changes from the actual EXE over to my RAM captures, but it misses things like defining various memory map blocks, and I assume other things I'm not even aware of.

Certainly the ability to run the analysis on other file types would not be the same as creating a new file format to describe the entire system state of the console, but it might be a small step in the direction of what the original poster was asking for. Is there now, or could there conceivably ever be, a way to do this?