Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Non-Common Functions Not Named #3

Open
ReclaimerShawn opened this issue Jul 17, 2021 · 2 comments
Open

Non-Common Functions Not Named #3

ReclaimerShawn opened this issue Jul 17, 2021 · 2 comments

Comments

@ReclaimerShawn
Copy link

ReclaimerShawn commented Jul 17, 2021

So, I've loaded my game's xex (Borderlands 2) into IDA 7.5 and I've noticed none of the game-related functions are labeled. I see loc_ and sub_ as their labels, but not the names of functions themselves. I'm used to seeing a comment titled DATA XREF: then the name of the function.

I know these functions should likely be named, as these functions were named on the PC and Nintendo Switch whenever I disassembled these games. Interestingly enough, the strings of some functions can be found in IDA Pro's Hex view, as I can see string in unexplored regions with the same names of functions that were on the Switch and PC. It's just these strings are unpaired with functions and subroutines.

I'm new to XEX disassembling, so is it common that all of a XEXs non-common functions aren't named? Is it something with my particular game? Is it due to my version of IDA Pro (I disassembled the game on the other consoles with IDA 7.0 and used 7.5 for Xbox 360 due to the fact that's the newest version of IDA the plugin would work for. I'm using IDA64 for both versions of the program)? Or is my problem related with the plugin itself?

@emoose
Copy link
Owner

emoose commented Jul 17, 2021

Only having names like loc_/sub_ is usually the norm when reversing a file without symbols, I'd guess in your case with PC/Switch there could be symbol names included somewhere (PDB file maybe? Switch executable files can sometimes have debug symbols embedded inside too IIRC)

Or maybe the executable had exported functions which can sometimes have their names included (you can see those in IDA's Exports view), X360 does support exported functions too, but since they aren't that common I haven't really tested the labelling for them that much.
Since you mentioned that you can find the names in the Hex view that makes me think that those were probably meant to be used for exports, maybe try comparing the Exports view in the X360 one against the PC one, if PC has them named while X360s are blank then there probably is an issue somewhere. Could you post some of the function names you expected/saw in the hex view?

Last thing I can think of is FLIRT signatures, IDA includes some signatures for things like fopen() and other C runtime libs, for PC/x86/x64 it has a good number of them mapped & named, but there's not really anything for X360/PPC.

@ReclaimerShawn
Copy link
Author

ReclaimerShawn commented Jul 17, 2021

Here's an example of some names I saw in the Hex View on X360:
AWillowPlayerControllerexecValidateItemDefinition
AWillowPlayerControllerexecValidateWeaponDefinition
AWillowPawnexecGetExpLevelForEquip

On the Nintendo Switch, these names are as following:
AWillowPlayerController::execValidateItemDefinition
AWillowPlayerController::execValidateWeaponDefinition
AWillowPawn::execGetExpLevelForEquip

Only on the Switch, these are associated with functions and not just in Hex View. I can confirm they're in Exports on the Nintendo Switch.

Looking at the PC Executable versus the X360 executable, I don't see those functions labeled as exports, but I see only 1 export in the X360 executable and I see 215 so far in the PC executable. I believe the people that made the hack on the PC used the game's SDK in order to make the hack (probably resolved the symbols, as the PC executable asked me for a file to resolve debug symbols). I simply ported that over from x86 to ARM on the Nintendo Switch, as the symbols were already in the Switch executable without further manipulation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants