Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Japanese PS2 elf files are not loading correctly into Ghidra #57

Open
hidemyaccount opened this issue Feb 18, 2024 · 4 comments
Open

Japanese PS2 elf files are not loading correctly into Ghidra #57

hidemyaccount opened this issue Feb 18, 2024 · 4 comments

Comments

@hidemyaccount
Copy link

hidemyaccount commented Feb 18, 2024

Hello Chaoticgd and Beardypig

I have a PS2 elf file with debug symbols extracted from a released Japanese soccer game (The extracted .elf file can be downloaded here https://drive.google.com/file/d/132KLm-plYiv3_UhJhHjP54FrTqBDA6LO/view?usp=sharing) that is unfortunately not loading correctly in Ghidra when using your emotion engine reloaded extension.

It is also happening for a second japanese PS2 soccer game (this game contains 2 elf files not 1) and the elf files are available here https://drive.google.com/file/d/11GG7dmsZkWURFCwSghLUaGtCBmoMUmww/view?usp=sharing

The majority of the functions in the symbol tree appear red for these games when loaded and are not clickable after the full analysis is performed.

There are errors reported in the log when I am initially loading the elf file into Ghidra and these are as follows:

There were too many messages to display.
134088 messages have been truncated.
Loading file:///C:/Temp/SLPM_622.17?MD5=d7346afe69aaf1dc6da3ee0536444014...
Skipping zero-length segment [12,Loadable segment] at address ram:01bc8000
Skipping section [formation.ovl] with invalid size 0x0
Skipping section [memorycard.ovl] with invalid size 0x0
Skipping section [select1.ovl] with invalid size 0x0
Skipping section [training.ovl] with invalid size 0x0
Skipping section [ovltest.ovl] with invalid size 0x0
Skipping section [title.ovl] with invalid size 0x0
Skipping section [ending.ovl] with invalid size 0x0
Skipping section [enter.ovl] with invalid size 0x0
Skipping section [game.ovl] with invalid size 0x0
Skipping section [leagcup.ovl] with invalid size 0x0
Skipping section [select.ovl] with invalid size 0x0
Skipping section [heap] with invalid size 0x0
Skipping section [filelist.ovl] with invalid size 0x0
_mips_gp0_value=0x1927470
Unable to perform relocation: Type = 2 (0x2) at 01a432f4 (Symbol = FclsF_MakeInfo) - Block is non-existent
Unable to perform relocation: Type = 2 (0x2) at 01a432e8 (Symbol = FclsD_MakeInfo) - Block is non-existent
Unable to perform relocation: Type = 2 (0x2) at 01a432e4 (Symbol = FclsI_MakeInfo) - Block is non-existent
Unable to perform relocation: Type = 2 (0x2) at 01a432e0 (Symbol = FclsR_MakeInfo) - Block is non-existent

The full error list can be viewed here.txt

I originally extracted the elf file from the PS2 game's bin file using "Elf Extract" https://www.psx-place.com/threads/elf-extractor-by-pelvicthrustman.19166/

And after restarting Ghidra, I double checked the extension is installed and I started a new project and loaded the Elf file.

beardypig1 installed the emotion engine extension and its enabled

beardypig import results and errors

beardypig functions dont work

Do you have have any idea or solution on how I can successfully load this elf file into Ghidra. Thank you for your work on the extension.

@hidemyaccount
Copy link
Author

hidemyaccount commented Feb 19, 2024

I should note that the names of the games causing issues are

World Soccer Winning Eleven 6 (Japan)
This games extracted elf file (github download link).zip

World Soccer Winning Eleven 6 - Final Evolution (Japan)

This second games extracted elf file (github download link).zip

I also tried disabling "Perform Symbol Relocations" when using Ghidra 11.0.1 and Emotion Engine SP13

and I tried importing the .elf using Ghidra 10.4 and SP11

However both of these do not fix the issue.

This tool https://github.com/horsicq/XELFViewer seems to parse the .elf files and its sections fine:

xl

xl2

@chaoticgd
Copy link
Owner

chaoticgd commented Feb 19, 2024

It looks like what's happening there is that the game is loading code from overlay files at runtime, so the functions that are red are probably not included in the ELF file. Since it's using the Metrowerks system for this, and Ghidra supports overlays, it would be possible to implement proper support for this in the future, but it's not there currently.

@chaoticgd
Copy link
Owner

chaoticgd commented Feb 19, 2024

So your options are:

  • Implement a system for loading the overlays into Ghidra yourself, or wait for me to do it (no time frame on that though).
  • Import an image of EE RAM with the overlay you want loaded and figure out how to import the symbols for said overlay into Ghidra.

If you want to have a shot at the former, I've attached a script I wrote to import level overlays from the R&C games: ImportLevelOverlays.txt.

Also, I don't know where this is from or if it's accurate, but someone sent me a struct that looks like the header for the MW overlays:

struct mwOverlayHeader3 // Found in PS2 games
{
    char identifier[3];             /* 'MWo' */
    char version;                   /* '3' */
    unsigned long id;               /* Same ID found in DWARF */
    unsigned long address;          /* Address where to load overlay */
    unsigned long sz_text;          /* Size of executable section */
    unsigned long sz_data;          /* Size of data section */
    unsigned long sz_bss;           /* Size of bss section */
    unsigned long _static_init;     /* Address of void(*__static_init[])(void) array */
    unsigned long _static_init_end; /* End address of static init array */
    char name[32];
};

@chaoticgd
Copy link
Owner

Note that the Ghidra script I included will not work in your case since it's intended for the R&C games, I just included it as a demonstration of how to use Ghidra's API. Also back when it was written, Ghidra didn't support multiple memory blocks for a single overlay, so that's why it clumps them all together.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants