Just discovered that Puzzle Bobble JAP has full debug information in the BOOT.BIN file :)
Steddy
OMG!!! - Full Debug Info
OMG!!! - Full Debug Info
Last edited by steddy on Mon Jun 13, 2005 7:32 am, edited 1 time in total.
Yep
I got two very close friends both got PSP's the same time as me and we never get the same stuff. Probably got every release there is.
What is the best tool to show the structures from the debug information including all the function calls and parameters?
ee-readelf -w seems to tell me that just about every Struct and Type in the PSP API is defined in there, but its not very readable.
Steddy
I got two very close friends both got PSP's the same time as me and we never get the same stuff. Probably got every release there is.
What is the best tool to show the structures from the debug information including all the function calls and parameters?
ee-readelf -w seems to tell me that just about every Struct and Type in the PSP API is defined in there, but its not very readable.
Steddy
Here an example of some code :)
Steddy
Code: Select all
00000464 <main>:
464: 27bdffc0 addiu sp,sp,-64
468: 3c050000 lui a1,0x0
46c: 3c040003 lui a0,0x3
470: 24a5042c addiu a1,a1,1068
474: 27a60010 addiu a2,sp,16
478: 2484dd04 addiu a0,a0,-8956
47c: 24020100 li v0,256
480: afbf0028 sw ra,40(sp)
484: afb10024 sw s1,36(sp)
488: 3c110000 lui s1,0x0
48c: e7b60038 swc1 $f22,56(sp)
490: e7b50034 swc1 $f21,52(sp)
494: e7b40030 swc1 $f20,48(sp)
498: afb00020 sw s0,32(sp)
49c: 0c00b568 jal 2d5a0 <sceKernelCreateCallback>
4a0: afa20010 sw v0,16(sp)
4a4: 0c00b532 jal 2d4c8 <sceKernelRegisterExitCallback>
4a8: 00402021 move a0,v0
4ac: 0c00b5a2 jal 2d688 <sceCtrlSetSamplingCycle>
4b0: 00002021 move a0,zero
4b4: 0c00b5a4 jal 2d690 <sceCtrlSetSamplingMode>
4b8: 24040001 li a0,1
4bc: 0c006a76 jal 1a9d8 <sceGuInit>
4c0: 00000000 nop
4c4: 3c050002 lui a1,0x2
4c8: 24a53c50 addiu a1,a1,15440
4cc: 00002021 move a0,zero
4d0: 0c006ab3 jal 1aacc <sceGuStart>
4d4: 3c060008 lui a2,0x8
4d8: 24040003 li a0,3
4dc: 00002821 move a1,zero
4e0: 0c0071b6 jal 1c6d8 <sceGuDrawBuffer>
4e4: 24060200 li a2,512
4e8: 3c060008 lui a2,0x8
4ec: 34c68000 ori a2,a2,0x8000
4f0: 24070200 li a3,512
4f4: 240401e0 li a0,480
4f8: 0c00722d jal 1c8b4 <sceGuDispBuffer>
4fc: 24050110 li a1,272
500: 3c040011 lui a0,0x11
504: 0c00720e jal 1c838 <sceGuDepthBuffer>
508: 24050200 li a1,512
50c: 24040710 li a0,1808
510: 0c007302 jal 1cc08 <sceGuOffset>
514: 24050778 li a1,1912
518: 240601e0 li a2,480
51c: 24070110 li a3,272
520: 24040800 li a0,2048
524: 0c007298 jal 1ca60 <sceGuViewport>
528: 24050800 li a1,2048
52c: 3404c350 li a0,0xc350
530: 0c0072bd jal 1caf4 <sceGuDepthRange>
534: 24052710 li a1,10000
538: 00002821 move a1,zero
53c: 240601e0 li a2,480
540: 24070110 li a3,272
544: 0c007611 jal 1d844 <sceGuScissor>
548: 00002021 move a0,zero
54c: 0c006c85 jal 1b214 <sceGuEnable>
550: 24040002 li a0,2
554: 00004021 move t0,zero
558: 00003821 move a3,zero
55c: 24050002 li a1,2
Well it Imports lots of other libraries that are present in the firmware and calls functions present in those too. So it is somewhat more useful than you may realize.Lex wrote:Puzzle Bobble comes with a newer Atrac3plus-lib and audiocodec prx.
Not so many functions to discover (sure except for the parameters),
a few sceAtrac-stuff (with two new hashes because of the new lib and
a yet unseen sceGu..., and we could correct a function name in sceCtrl)
Steddy
Last edited by steddy on Mon Jun 13, 2005 8:29 am, edited 1 time in total.
Ps2Dis really doesn't seem to like debug information. It fills most of the files with 0x88 when loaded :(
I am having to use ee-objdump but that doesn't do analysis of pointers to string sections. Anyone know of anything else for debuging that will show me what parameters are actually pointing at?
Steddy
I am having to use ee-objdump but that doesn't do analysis of pointers to string sections. Anyone know of anything else for debuging that will show me what parameters are actually pointing at?
Steddy
-
0xdeadface
- Posts: 62
- Joined: Tue May 31, 2005 5:11 am
Maybe this is n00b but in the filelist.txt (posted on another site) for Twisted Metal Head On there's a rinit.prx.nodebug and a rinit.prx; perhaps this rinit.prx contains some debug information as well and it was forgotten to delete it and replace it with the nodebug version?
Edit: clarification / typo
Edit: clarification / typo
Last edited by Marco_N on Mon Jun 13, 2005 9:07 am, edited 2 times in total.
Yep, and that means the source to those functions is present in the debug output.djhuevo wrote:sceGu is a library that compile static, not a module.
For example:
Code: Select all
0001c974 <sceGuDisplay>:
1c974: 27bdfff0 addiu sp,sp,-16
1c978: 3c090052 lui t1,0x52
1c97c: afb00000 sw s0,0(sp)
1c980: 00002821 move a1,zero
1c984: 00003021 move a2,zero
1c988: afbf0004 sw ra,4(sp)
1c98c: 24070001 li a3,1
1c990: 00808021 move s0,a0
1c994: 10800008 beqz a0,1c9b8 <sceGuDisplay+0x44>
1c998: 25287a90 addiu t0,t1,31376
1c99c: 3c020052 lui v0,0x52
1c9a0: 8c447a30 lw a0,31280(v0)
1c9a4: 8d03000c lw v1,12(t0)
1c9a8: 8d050004 lw a1,4(t0)
1c9ac: 8d267a90 lw a2,31376(t1)
1c9b0: 00832021 addu a0,a0,v1
1c9b4: 24070001 li a3,1
1c9b8: 0c00b5aa jal 2d6a8 <sceDisplaySetFrameBuf>
1c9bc: 00000000 nop
1c9c0: 3c030052 lui v1,0x52
1c9c4: 8c627a84 lw v0,31364(v1)
1c9c8: 8fbf0004 lw ra,4(sp)
1c9cc: ac707a84 sw s0,31364(v1)
1c9d0: 8fb00000 lw s0,0(sp)
1c9d4: 03e00008 jr ra
1c9d8: 27bd0010 addiu sp,sp,16Here are all the module imports it contains:-
Code: Select all
0002d480 <sceIoRead>:
0002d488 <sceIoWrite>:
0002d490 <sceIoLseek>:
0002d498 <sceIoDevctl>:
0002d4a0 <sceIoClose>:
0002d4a8 <sceIoOpen>:
0002d4b0 <sceKernelCpuSuspendIntr>:
0002d4b8 <sceKernelCpuResumeIntr>:
0002d4c0 <sceKernelExitGame>:
0002d4c8 <sceKernelRegisterExitCallback>:
0002d4d0 <sceKernelLoadModuleByID>:
0002d4d8 <sceKernelLoadModule>:
0002d4e0 <sceKernelStartModule>:
0002d4e8 <sceKernelStopModule>:
0002d4f0 <sceKernelUnloadModule>:
0002d4f8 <sceKernelSelfStopUnloadModule>:
0002d500 <sceKernelStdin>:
0002d508 <sceKernelStdout>:
0002d510 <sceKernelStderr>:
0002d518 <sceKernelAllocPartitionMemory>:
0002d520 <sceKernelFreePartitionMemory>:
0002d528 <sceKernelGetBlockHeadAddr>:
0002d530 <sceKernelCreateThread>:
0002d538 <sceKernelDeleteThread>:
0002d540 <sceKernelStartThread>:
0002d548 <sceKernelExitThread>:
0002d550 <sceKernelExitDeleteThread>:
0002d558 <sceKernelWaitThreadEnd>:
0002d560 <sceKernelDelayThread>:
0002d568 <sceKernelDelayThreadCB>:
0002d570 <sceKernelCreateEventFlag>:
0002d578 <sceKernelDeleteEventFlag>:
0002d580 <sceKernelSetEventFlag>:
0002d588 <sceKernelClearEventFlag>:
0002d590 <sceKernelWaitEventFlag>:
0002d598 <sceKernelPollEventFlag>:
0002d5a0 <sceKernelCreateCallback>:
0002d5a8 <sceKernelGetSystemTimeLow>:
0002d5b0 <sceKernelLibcClock>:
0002d5b8 <sceKernelLibcTime>:
0002d5c0 <sceKernelLibcGettimeofday>:
0002d5c8 <sceKernelDcacheWritebackAll>:
0002d5d0 <sceAtracReleaseAtracID>:
0002d5d8 <sceAtracSetDataAndGetID>:
0002d5e0 <sceAtracDecodeData>:
0002d5e8 <sceAtracGetRemainFrame>:
0002d5f0 <sceAtracGetStreamDataInfo>:
0002d5f8 <sceAtracAddStreamData>:
0002d600 <sceAtracGetSecondBufferInfo>:
0002d608 <sceAtracSetSecondBuffer>:
0002d610 <sceAtracGetNextDecodePosition>:
0002d618 <sceAtracGetSoundSample>:
0002d620 <sceAtracSetLoopNum>:
0002d628 <sceAtracGetBufferInfoForReseting>:
0002d630 <sceAtracResetPlayPosition>:
0002d638 <sceAtracGetInternalErrorInfo>:
0002d640 <sceAudioOutputBlocking>:
0002d648 <sceAudioOutputPanned>:
0002d650 <sceAudioOutputPannedBlocking>:
0002d658 <sceAudioChReserve>:
0002d660 <sceAudioChRelease>:
0002d668 <sceAudioGetChannelRestLen>:
0002d670 <sceAudioSetChannelDataLen>:
0002d678 <sceAudioChangeChannelConfig>:
0002d680 <sceAudioChangeChannelVolume>:
0002d688 <sceCtrlSetSamplingCycle>:
0002d690 <sceCtrlSetSamplingMode>:
0002d698 <sceCtrlReadBufferPositive>:
0002d6a0 <sceDisplaySetMode>:
0002d6a8 <sceDisplaySetFrameBuf>:
0002d6b0 <sceDisplayGetVcount>:
0002d6b8 <sceDisplayWaitVblankCB>:
0002d6c0 <sceDisplayWaitVblankStart>:
0002d6c8 <sceGeEdramGetAddr>:
0002d6d0 <sceGeListEnQueue>:
0002d6d8 <sceGeListEnQueueHead>:
0002d6e0 <sceGeListUpdateStallAddr>:
0002d6e8 <sceGeListSync>:
0002d6f0 <sceGeDrawSync>:
0002d6f8 <sceGeBreak>:
0002d700 <sceGeContinue>:
0002d708 <sceGeSetCallback>:
0002d710 <sceGeUnsetCallback>:
0002d718 <sceUmdActivate>:
0002d720 <sceUmdGetDriveStat>:
0002d728 <sceUtilitySavedataInitStart>:
0002d730 <sceUtilitySavedataShutdownStart>:
0002d738 <sceUtilitySavedataUpdate>:
0002d740 <sceUtilitySavedataGetStatus>:
any chance of finding out some gu commands for drawing and rendering polygons or surfaces?
As for the person asking about puzzle bobble. The classic arcade versions are the best. So the Neo CD ver of puzzle bobble 1 is the best one posible on the psp. Have not played the psp version but was not to keen on its looks & cost.
As for the person asking about puzzle bobble. The classic arcade versions are the best. So the Neo CD ver of puzzle bobble 1 is the best one posible on the psp. Have not played the psp version but was not to keen on its looks & cost.
I already know the answer to that one and its pretty complex.Shine wrote:That's interesting. Perhaps you can find out the parameters for sceUtilitySavedataInitStart and the other savegame functions? If we can reverse engineering it, it would be possible to write PSP programs, which modify savegames for creating exploits or even cheats :-)
static SceUtilitySavedataParam save_param;
int retval = sceUtilitySavedataInitStart(&save_param);
The trick is in working out the format of SceUtilitySavedataParam without access to the devkit.
Steddy
-
Guest
Edited: see http://forums.ps2dev.org/viewtopic.php?t=2218steddy wrote: I already know the answer to that one and its pretty complex.
static SceUtilitySavedataParam save_param;
int retval = sceUtilitySavedataInitStart(&save_param);