Understanding R2 register

[ptasev]

Hi, thanks for your scripts. I'm new to PS3 and I'm struggling to understand how to find data at a location offset from r2 register. I have a proto build so I used the AssignPs3R2FromOpd script. For example, here it's loading floats from a location based on r2, but I'm not sure how to find that data.

[VelocityRa]

Did you follow the usage instructions exactly? Specifically adding r2 to the unaffected list.

If that doesn't work - what happens if you manually set R2 for that function?

Why did you need to use that script in the first place? What's its output?

Also, some more info here: NationalSecurityAgency/ghidra#570

[ptasev]

Yep, these are the steps I took:

1. Modify ppc_64_32.cspec to add r2 to the unaffected list.
2. Selected PowerISA-Altivec-64-32addr big endian
3. Ran auto-analysis
4. Ran AssignPs3R2FromOpd.java
5. Ran DefinePs3Syscalls.java

The reason I used that script, and those instructions, is because with the AnalyzePs3Binary.java script the r2 values were pointing to the wrong locations. This is where I got these alternative instructions:
#5 (comment)

Can you help me understand how to calculate the R2 location for a function manually? These are some of the sections I have:

[ptasev]

I set R2 for one of the functions I was looking at to 0x12cd0f8 and it appears to be working. I wonder why it's not getting set up automatically.

[VelocityRa]

I see.

Can you help me understand how to calculate the R2 location for a function manually?

I don't know about these weird elfs but for normal ones you just go to their first xref and then the next (or previous, idr) word on it is the R2/TOC value.

I wonder why it's not getting set up automatically.

This is why I asked for output when you run the script.
If there's nothing useful you could also add some additional logging if you know some Java to help debug it.

[ptasev]

Reading through the code of the AssignPs3R2FromOpd script, it goes through every 8 bytes of the .opd section and considers the first 4 bytes as a function address, and the next 4 as the R2/TOC value. This actually works for many functions and R2 is getting set correctly. A little snippet from the end of the log for reference:

AssignPs3R2FromOpd.java> data: 1580024 toc: 19714296
AssignPs3R2FromOpd.java> [[00181bf8, 00181c2f]]
AssignPs3R2FromOpd.java> data: 1583848 toc: 19714296
AssignPs3R2FromOpd.java> [[00182ae8, 00182aff]]
AssignPs3R2FromOpd.java> data: 1583944 toc: 19714296
AssignPs3R2FromOpd.java> [[00182b48, 00182b57]]
AssignPs3R2FromOpd.java> Found 3 tocs.
AssignPs3R2FromOpd.java> Finished!

However, some functions are not getting R2 set at all. I ended up putting the following else block here to see if perhaps Ghidra does not think there's a function at some of the addresses.

Ps3GhidraScripts/ghidra_scripts/AssignPs3R2FromOpd.java

Lines 120 to 131 in 070225e

	for (long i = 0; i < opdSize; i+= 8) {
	final int dataPtr = memory.getInt(opdAddress.add(i)); // To function / data
	final int tocPtr = memory.getInt(opdAddress.add(i + 4));
	tocs.add(tocPtr);
	println("data: "+dataPtr+" toc: "+tocPtr);
	final Address funcOrData = currentAddress.getNewAddress(dataPtr);
	final Function functionAt = currentProgram.getFunctionManager().getFunctionAt(funcOrData);
	if (functionAt != null) {
	println(""+functionAt.getBody());
	setFunctionR2(functionAt, tocPtr);
	}

	    else {
		println("Func not found at: "+funcOrData);
	    }

The logs didn't end up showing that message at all. That makes me think that perhaps some functions either store their R2 value elsewhere, or it needs to be figured out through some other context. Looking at all the xrefs of such functions does not lead me to any section that contains their R2 value.

I'm not sure how to proceed from here, but I can at least work around it now by manually setting it to one of the known R2 values from the .opd section.

[ptasev]

Right after posting I realized that the script console output view has a limit for how much text it can show. I removed some of the repetitive logging and it does indeed show that at some addresses Ghidra does not believe there is a function there. Strangely, the functions I've been scrutinizing the most are not in this not found list.

AssignPs3R2FromOpd.java> Running...
AssignPs3R2FromOpd.java> segment_0.1
AssignPs3R2FromOpd.java> .init
AssignPs3R2FromOpd.java> .text
AssignPs3R2FromOpd.java> .fini
AssignPs3R2FromOpd.java> .sceStub.text
AssignPs3R2FromOpd.java> .eh_frame
AssignPs3R2FromOpd.java> .rodata.sceResident
AssignPs3R2FromOpd.java> .rodata.sceFNID
AssignPs3R2FromOpd.java> .lib.ent.top
AssignPs3R2FromOpd.java> .lib.ent.btm
AssignPs3R2FromOpd.java> .lib.stub.top
AssignPs3R2FromOpd.java> .lib.stub
AssignPs3R2FromOpd.java> .lib.stub.btm
AssignPs3R2FromOpd.java> .rodata
AssignPs3R2FromOpd.java> .spu_image
AssignPs3R2FromOpd.java> .sys_proc_param
AssignPs3R2FromOpd.java> .sys_proc_prx_param
AssignPs3R2FromOpd.java> .ctors
AssignPs3R2FromOpd.java> .dtors
AssignPs3R2FromOpd.java> .jcr
AssignPs3R2FromOpd.java> .data.rel.ro
AssignPs3R2FromOpd.java> .data.sceFStub
AssignPs3R2FromOpd.java> .toc1
AssignPs3R2FromOpd.java> .opd
AssignPs3R2FromOpd.java> .got
AssignPs3R2FromOpd.java> .tdata
AssignPs3R2FromOpd.java> .tbss
AssignPs3R2FromOpd.java> .data
AssignPs3R2FromOpd.java> .bss
AssignPs3R2FromOpd.java> EXTERNAL
AssignPs3R2FromOpd.java> .debug_abbrev
AssignPs3R2FromOpd.java> .debug_aranges
AssignPs3R2FromOpd.java> .debug_frame
AssignPs3R2FromOpd.java> .debug_info
AssignPs3R2FromOpd.java> .debug_libgenfunc
AssignPs3R2FromOpd.java> .debug_line
AssignPs3R2FromOpd.java> .debug_loc
AssignPs3R2FromOpd.java> .debug_pubnames
AssignPs3R2FromOpd.java> .debug_ranges
AssignPs3R2FromOpd.java> .debug_str
AssignPs3R2FromOpd.java> .sceversion
AssignPs3R2FromOpd.java> .shstrtab
AssignPs3R2FromOpd.java> .strtab
AssignPs3R2FromOpd.java> .symtab
AssignPs3R2FromOpd.java> _elfSectionHeaders
AssignPs3R2FromOpd.java> opd address: 0126dd60
AssignPs3R2FromOpd.java> opdEntries: 28802
AssignPs3R2FromOpd.java> opdSize:230416
AssignPs3R2FromOpd.java> Func not found at: 0010cbc8
AssignPs3R2FromOpd.java> Func not found at: 0010cc50
AssignPs3R2FromOpd.java> Func not found at: 00112570
AssignPs3R2FromOpd.java> Func not found at: 0012f4f4
AssignPs3R2FromOpd.java> Func not found at: 00138984
AssignPs3R2FromOpd.java> Func not found at: 00138d2c
AssignPs3R2FromOpd.java> Func not found at: 00138dbc
AssignPs3R2FromOpd.java> Func not found at: 00138e2c
AssignPs3R2FromOpd.java> Func not found at: 00138e8c
AssignPs3R2FromOpd.java> Func not found at: 00139040
AssignPs3R2FromOpd.java> Func not found at: 001390b8
AssignPs3R2FromOpd.java> Func not found at: 001390c8
AssignPs3R2FromOpd.java> Func not found at: 00139104
AssignPs3R2FromOpd.java> Func not found at: 00139d64
AssignPs3R2FromOpd.java> Func not found at: 00139ddc
AssignPs3R2FromOpd.java> Func not found at: 0013c7bc
AssignPs3R2FromOpd.java> Func not found at: 0013c88c
AssignPs3R2FromOpd.java> Func not found at: 0013c990
AssignPs3R2FromOpd.java> Func not found at: 0013c9a4
AssignPs3R2FromOpd.java> Func not found at: 0013c9ac
AssignPs3R2FromOpd.java> Func not found at: 0013caa4
AssignPs3R2FromOpd.java> Func not found at: 0013cb7c
AssignPs3R2FromOpd.java> Func not found at: 0013cc54
AssignPs3R2FromOpd.java> Func not found at: 0013cc64
AssignPs3R2FromOpd.java> Func not found at: 0013ccc8
AssignPs3R2FromOpd.java> Func not found at: 0013ccd8
AssignPs3R2FromOpd.java> Func not found at: 0013cd24
AssignPs3R2FromOpd.java> Func not found at: 0013cd98
AssignPs3R2FromOpd.java> Func not found at: 0013ce9c
AssignPs3R2FromOpd.java> Func not found at: 0013cf3c
AssignPs3R2FromOpd.java> Func not found at: 0013cfb8
AssignPs3R2FromOpd.java> Func not found at: 0013cfc0
AssignPs3R2FromOpd.java> Func not found at: 0013cfdc
AssignPs3R2FromOpd.java> Func not found at: 0013d070
AssignPs3R2FromOpd.java> Func not found at: 0013d0ac
AssignPs3R2FromOpd.java> Func not found at: 0013d0e8
AssignPs3R2FromOpd.java> Func not found at: 0013d0fc
AssignPs3R2FromOpd.java> Func not found at: 0013d160
AssignPs3R2FromOpd.java> Func not found at: 0013d1c8
AssignPs3R2FromOpd.java> Func not found at: 0013d284
AssignPs3R2FromOpd.java> Func not found at: 0013d3a0
AssignPs3R2FromOpd.java> Func not found at: 0013d590
AssignPs3R2FromOpd.java> Func not found at: 0013d66c
AssignPs3R2FromOpd.java> Func not found at: 0013d728
AssignPs3R2FromOpd.java> Func not found at: 0013d844
AssignPs3R2FromOpd.java> Func not found at: 0013da34
AssignPs3R2FromOpd.java> Func not found at: 0013db10
AssignPs3R2FromOpd.java> Func not found at: 0013dbf0
AssignPs3R2FromOpd.java> Func not found at: 0013dcc0
AssignPs3R2FromOpd.java> Func not found at: 0013ddc8
AssignPs3R2FromOpd.java> Func not found at: 0013e3f0
AssignPs3R2FromOpd.java> Func not found at: 0013e9a8
AssignPs3R2FromOpd.java> Func not found at: 0013ea50
AssignPs3R2FromOpd.java> Func not found at: 0013ea54
AssignPs3R2FromOpd.java> Func not found at: 0013ea90
AssignPs3R2FromOpd.java> Func not found at: 0013eaa4
AssignPs3R2FromOpd.java> Func not found at: 0013eaac
AssignPs3R2FromOpd.java> Func not found at: 0013eafc
AssignPs3R2FromOpd.java> Func not found at: 0013ebb8
AssignPs3R2FromOpd.java> Func not found at: 0013ec48
AssignPs3R2FromOpd.java> Func not found at: 0013ec6c
AssignPs3R2FromOpd.java> Func not found at: 0013ecfc
AssignPs3R2FromOpd.java> Func not found at: 0013ed0c
AssignPs3R2FromOpd.java> Func not found at: 0013ed18
AssignPs3R2FromOpd.java> Func not found at: 0013edc4
AssignPs3R2FromOpd.java> Func not found at: 0013ee54
AssignPs3R2FromOpd.java> Func not found at: 0013ee90
AssignPs3R2FromOpd.java> Func not found at: 0013eecc
AssignPs3R2FromOpd.java> Func not found at: 0013f100
AssignPs3R2FromOpd.java> Func not found at: 0013f924
AssignPs3R2FromOpd.java> Func not found at: 0013f988
AssignPs3R2FromOpd.java> Func not found at: 0013f9c4
AssignPs3R2FromOpd.java> Func not found at: 0013fa00
AssignPs3R2FromOpd.java> Func not found at: 0013ffd8
AssignPs3R2FromOpd.java> Func not found at: 00140040
AssignPs3R2FromOpd.java> Func not found at: 00140044
AssignPs3R2FromOpd.java> Func not found at: 00140050
AssignPs3R2FromOpd.java> Func not found at: 00140088
AssignPs3R2FromOpd.java> Func not found at: 001400a4
AssignPs3R2FromOpd.java> Func not found at: 00140138
AssignPs3R2FromOpd.java> Func not found at: 00140254
AssignPs3R2FromOpd.java> Func not found at: 00140270
AssignPs3R2FromOpd.java> Func not found at: 00140278
AssignPs3R2FromOpd.java> Func not found at: 001403d4
AssignPs3R2FromOpd.java> Func not found at: 0014043c
AssignPs3R2FromOpd.java> Func not found at: 001404d4
AssignPs3R2FromOpd.java> Func not found at: 0014052c
AssignPs3R2FromOpd.java> Func not found at: 00140580
AssignPs3R2FromOpd.java> Func not found at: 001406fc
AssignPs3R2FromOpd.java> Func not found at: 0014074c
AssignPs3R2FromOpd.java> Func not found at: 001407d0
AssignPs3R2FromOpd.java> Func not found at: 00140820
AssignPs3R2FromOpd.java> Func not found at: 00140840
AssignPs3R2FromOpd.java> Func not found at: 00140890
AssignPs3R2FromOpd.java> Func not found at: 00140914
AssignPs3R2FromOpd.java> Func not found at: 00140964
AssignPs3R2FromOpd.java> Func not found at: 0014097c
AssignPs3R2FromOpd.java> Func not found at: 001409cc
AssignPs3R2FromOpd.java> Func not found at: 001409e8
AssignPs3R2FromOpd.java> Func not found at: 00140a38
AssignPs3R2FromOpd.java> Func not found at: 00140b54
AssignPs3R2FromOpd.java> Func not found at: 00140ba4
AssignPs3R2FromOpd.java> Func not found at: 00140cc8
AssignPs3R2FromOpd.java> Func not found at: 00140d30
AssignPs3R2FromOpd.java> Func not found at: 00140d38
AssignPs3R2FromOpd.java> Func not found at: 00140e28
AssignPs3R2FromOpd.java> Func not found at: 00140f80
AssignPs3R2FromOpd.java> Func not found at: 00140ff8
AssignPs3R2FromOpd.java> Func not found at: 00141000
AssignPs3R2FromOpd.java> Func not found at: 00141150
AssignPs3R2FromOpd.java> Func not found at: 00141200
AssignPs3R2FromOpd.java> Func not found at: 00141300
AssignPs3R2FromOpd.java> Func not found at: 0014141c
AssignPs3R2FromOpd.java> Func not found at: 001415a0
AssignPs3R2FromOpd.java> Func not found at: 001415b8
AssignPs3R2FromOpd.java> Func not found at: 001415c4
AssignPs3R2FromOpd.java> Func not found at: 001415cc
AssignPs3R2FromOpd.java> Func not found at: 00141624
AssignPs3R2FromOpd.java> Func not found at: 0014167c
AssignPs3R2FromOpd.java> Func not found at: 001416d4
AssignPs3R2FromOpd.java> Func not found at: 0014172c
AssignPs3R2FromOpd.java> Func not found at: 00141c30
AssignPs3R2FromOpd.java> Func not found at: 00141c88
AssignPs3R2FromOpd.java> Func not found at: 00141d0c
AssignPs3R2FromOpd.java> Func not found at: 00141d94
AssignPs3R2FromOpd.java> Func not found at: 00141ea8
AssignPs3R2FromOpd.java> Func not found at: 00141f8c
AssignPs3R2FromOpd.java> Func not found at: 0014235c
AssignPs3R2FromOpd.java> Func not found at: 001423b4
AssignPs3R2FromOpd.java> Func not found at: 00142428
AssignPs3R2FromOpd.java> Func not found at: 001424a0
AssignPs3R2FromOpd.java> Func not found at: 0014254c
AssignPs3R2FromOpd.java> Func not found at: 001425e4
AssignPs3R2FromOpd.java> Func not found at: 00142ad0
AssignPs3R2FromOpd.java> Func not found at: 00142b28
AssignPs3R2FromOpd.java> Func not found at: 00142b94
AssignPs3R2FromOpd.java> Func not found at: 00142c04
AssignPs3R2FromOpd.java> Func not found at: 00142cf8
AssignPs3R2FromOpd.java> Func not found at: 00142db0
AssignPs3R2FromOpd.java> Func not found at: 00143140
AssignPs3R2FromOpd.java> Func not found at: 00143198
AssignPs3R2FromOpd.java> Func not found at: 001431fc
AssignPs3R2FromOpd.java> Func not found at: 00143264
AssignPs3R2FromOpd.java> Func not found at: 001432f0
AssignPs3R2FromOpd.java> Func not found at: 00143378
AssignPs3R2FromOpd.java> Func not found at: 001435e8
AssignPs3R2FromOpd.java> Func not found at: 001436ec
AssignPs3R2FromOpd.java> Func not found at: 001437f0
AssignPs3R2FromOpd.java> Func not found at: 00fcb008
AssignPs3R2FromOpd.java> Found 3 tocs.
AssignPs3R2FromOpd.java> Finished!