PPU Analyzer, MGS4: Firmware/import caller analysis and KLIC finding pass - #16764
Conversation
46c6024 to
516a534
Compare
|
I know it's just a draft, but here are the results from the games I've tested:
|
|
@cipherxof Retest with latest commit please. |
ed8287c to
416d7de
Compare
|
MGS4 works now. The rest of the games still fail to find the klic (tested about 7 games) I looked into Castlevania and Journey specifically, and both write to the klic address that's passed to the drm functions at runtime. (See #16743 (comment)) Journey: void FUN_001c4318(undefined8 param_1,undefined8 param_2,undefined8 param_3)
{
undefined auStack_30 [16];
memcpy(auStack_30,&DAT_00d97158,0x10);
sceNpDrmIsAvailable(auStack_30,param_1);
sys_prx_load_module(param_1,param_2,param_3);
return;
}0xd97158 is zeroed out initially. It actually gets loaded from a hex string somewhere else at runtime, which again is probably another convoluted pattern to match against. I suspect the rest of the games are in a similar situation as these. Either way, I'm glad MGS4 will eventually be able to precompile modules on the master build, and it seems you've laid the framework for some other potential features that might require import matching. I can't help but wonder if this will work for any game besides MGS4 though 😅 |
This pull request implements initial import / firmware functions caller analysis.
While many uses are now possible, I implemented one use for Metal Gear Solid 4.
The use here is to statically analyse the firmware calls to sceNpDrm which contain the key in passed arguments to the function to decrypt its executable.
This is required in order to precompile its PPU LLVM cache properly for all its executables.
Implements #16748
Fixes #12320