-
Notifications
You must be signed in to change notification settings - Fork 17
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Non-Common Functions Not Named #3
Comments
Only having names like loc_/sub_ is usually the norm when reversing a file without symbols, I'd guess in your case with PC/Switch there could be symbol names included somewhere (PDB file maybe? Switch executable files can sometimes have debug symbols embedded inside too IIRC) Or maybe the executable had exported functions which can sometimes have their names included (you can see those in IDA's Exports view), X360 does support exported functions too, but since they aren't that common I haven't really tested the labelling for them that much. Last thing I can think of is FLIRT signatures, IDA includes some signatures for things like fopen() and other C runtime libs, for PC/x86/x64 it has a good number of them mapped & named, but there's not really anything for X360/PPC. |
Here's an example of some names I saw in the Hex View on X360: On the Nintendo Switch, these names are as following: Only on the Switch, these are associated with functions and not just in Hex View. I can confirm they're in Exports on the Nintendo Switch. Looking at the PC Executable versus the X360 executable, I don't see those functions labeled as exports, but I see only 1 export in the X360 executable and I see 215 so far in the PC executable. I believe the people that made the hack on the PC used the game's SDK in order to make the hack (probably resolved the symbols, as the PC executable asked me for a file to resolve debug symbols). I simply ported that over from x86 to ARM on the Nintendo Switch, as the symbols were already in the Switch executable without further manipulation. |
So, I've loaded my game's xex (Borderlands 2) into IDA 7.5 and I've noticed none of the game-related functions are labeled. I see loc_ and sub_ as their labels, but not the names of functions themselves. I'm used to seeing a comment titled DATA XREF: then the name of the function.
I know these functions should likely be named, as these functions were named on the PC and Nintendo Switch whenever I disassembled these games. Interestingly enough, the strings of some functions can be found in IDA Pro's Hex view, as I can see string in unexplored regions with the same names of functions that were on the Switch and PC. It's just these strings are unpaired with functions and subroutines.
I'm new to XEX disassembling, so is it common that all of a XEXs non-common functions aren't named? Is it something with my particular game? Is it due to my version of IDA Pro (I disassembled the game on the other consoles with IDA 7.0 and used 7.5 for Xbox 360 due to the fact that's the newest version of IDA the plugin would work for. I'm using IDA64 for both versions of the program)? Or is my problem related with the plugin itself?
The text was updated successfully, but these errors were encountered: