Skip to content

PPU Analyzer, MGS4: Firmware/import caller analysis and KLIC finding pass - #16764

Merged
elad335 merged 1 commit into
RPCS3:masterfrom
elad335:mgs4
Feb 27, 2025
Merged

elad335 merged 1 commit into
RPCS3:masterfrom
elad335:mgs4

Conversation

@elad335

@elad335 elad335 commented Feb 26, 2025

Copy link
Copy Markdown
Contributor

This pull request implements initial import / firmware functions caller analysis.
While many uses are now possible, I implemented one use for Metal Gear Solid 4.
The use here is to statically analyse the firmware calls to sceNpDrm which contain the key in passed arguments to the function to decrypt its executable.
This is required in order to precompile its PPU LLVM cache properly for all its executables.

Implements #16748
Fixes #12320

@cipherxof

Copy link
Copy Markdown
Contributor

I know it's just a draft, but here are the results from the games I've tested:

  1. ❌ Castlevania: Harmony of Despair (fails ~117 modules)
  2. ❌ FFXIII-2 Demo (crashes)
  3. ❌ MGS4 (crashes)
  4. ❌ Journey (fails 2 modules)

RPCS3.log.gz

@elad335

elad335 commented Feb 26, 2025

Copy link
Copy Markdown
Contributor Author

@cipherxof Retest with latest commit please.

@elad335
elad335 force-pushed the mgs4 branch 3 times, most recently from ed8287c to 416d7de Compare February 26, 2025 15:34
@elad335
elad335 marked this pull request as ready for review February 26, 2025 15:35
@cipherxof

cipherxof commented Feb 26, 2025

Copy link
Copy Markdown
Contributor

MGS4 works now. The rest of the games still fail to find the klic (tested about 7 games)

I looked into Castlevania and Journey specifically, and both write to the klic address that's passed to the drm functions at runtime. (See #16743 (comment))

Journey:

void FUN_001c4318(undefined8 param_1,undefined8 param_2,undefined8 param_3)

{
  undefined auStack_30 [16];
  
  memcpy(auStack_30,&DAT_00d97158,0x10);
  sceNpDrmIsAvailable(auStack_30,param_1);
  sys_prx_load_module(param_1,param_2,param_3);
  return;
}

0xd97158 is zeroed out initially. It actually gets loaded from a hex string somewhere else at runtime, which again is probably another convoluted pattern to match against. I suspect the rest of the games are in a similar situation as these.

Either way, I'm glad MGS4 will eventually be able to precompile modules on the master build, and it seems you've laid the framework for some other potential features that might require import matching. I can't help but wonder if this will work for any game besides MGS4 though 😅

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Task] PPU Analyser: Import caller analysis pass for KLIC finding. (needed for MGS4) PPU LLVM Precomp not working properly if MGS4 is updated to 2.00

2 participants