Questions tagged [powerpc]
The powerpc tag has no usage guidance.
22 questions
0
votes
0
answers
16
views
SPC56xx reference to unmapped memory SDA2 (0x80000000)
I'm reversing a binary built for the spc563m64 processor. The R2 (SDA2) register is set to 0x80008400 and this value is used to read and write the address space "near" that value throughout ...
0
votes
0
answers
28
views
PowerPC Macintosh code injection
I'm reverse engineering a game for the old PowerPC MacOS 9 pc via the static analysis in IDA Pro windows but I want to inject code during runtime(for example via the dynamic library) in an emulator ...
- 33
1
vote
1
answer
229
views
PowerPC disassemble with objdump
I am trying to disassemble PowerPC dump with objdump. I have only raw binary dump, not ELF or any other 'container'.
Unfortunately, I cannot find any option to force VLE mode (my binary definitely ...
- 168
0
votes
1
answer
133
views
PowerPC disassembly with libopcodes
I want to disassemble Wii game executable binaries in C, which use the broadway microprocessor and unfortunately the only disassembler I am aware that I can use is libopcodes.
I am following this ...
- 11
2
votes
0
answers
245
views
How to correct decompiled output with `in_stack_` (ppc BE)?
So I have something like:
*************************************************************
* SYS_DRAW_BATCH_RUNS_DATA::Set(matrix4 const*, RECTF con ..
...
- 475
0
votes
0
answers
81
views
How does `bne` know which bit field in the condition register to branch on? (PowerPC Gekko)
I'm currently reversing a PowerPC Gekko program and saw a bne instruction that branched on the condition register after a rlwinm function. Perfect. That makes sense. bne is checking the third bit of ...
2
votes
1
answer
260
views
MPC562 and M58BW016 Flash operations
I am trying to modify the Flash memory of a board with a Freescale MPC562 processor, using an external 2 MB Flash chip M58BW016. So far I've been able to successfully read and write the chip's ...
- 41
0
votes
2
answers
297
views
calculate branch target address powerpc
I want to know how next instruction address (NIA) is calculated for BL instruction. Lets assume that there is such instruction:
.text:100004C8 BL sub_10000670.
This command in hex is:
48 00 01 ...
- 121
4
votes
1
answer
2k
views
PowerPC TOC and SDA
I'm trying to understand the concepts of the TOC and SDA in PowerPC.
From what I understand, they are basically pointers to tables of global values, when TOC is stored in r2, and SDA in r13.
But ...
- 1,858
1
vote
1
answer
317
views
vector table address in mpcXXXX microcontrollers
I'm disassembling some mpcXXXX microcontroller firmware, and I'm trying to find the vector table and the reset interrupt.
For example, I know that in ARM, in some of the microcontrollers, the vector ...
- 1,858
2
votes
1
answer
420
views
PowerPC ELF32 detecting VLE
I am writing an ELF32 parser and disassembler for PowerPC.
Does anyone knows how to detect if the file is using VLE architecture from ELF header? I see that IDA can do it automatically.
- 367
2
votes
1
answer
474
views
moving info from one register to another using dot, powerpc
There are three simple instructions from Power PC assembly:
mr. r7, r3
li r3, 0
beqlr
Well, if i understand here all lines correctly, i move value from register r3 to r9, load r3 with 0 and jump to ...
- 121
1
vote
1
answer
139
views
Powermac gdbserver wrapper/How to attach IDA to powermac application?
How do I debug a powermac application using gdbserver provided there is no gdbserver
I've tried compiling various version of gdb found in apple opensource -specifically the gdbserver part but it ...
- 475
2
votes
1
answer
2k
views
IDA Pro PowerPC Decompiler Plugin supporting Floating Point Instructions
So I far I have been using Snowman for PowerPC decompilation. It is bad though but better than nothing. However, right now it doesn't support floating point instructions. They are simply written down ...
- 151
4
votes
2
answers
945
views
IDA Pro: Define local variables from non-standard powerpc stack register
I am using IDA pro 6.95 (paid version) to RE some PowerPC code. The PowerPC normally uses r1 as the stack pointer, so IDA builds the stack frame and local variables from r1. Parameters are passed in ...
- 41
1
vote
1
answer
90
views
Copy Export Symbols From Mac to Windows PE
I have both a Mac and Windows version of the same library. However, while the Mac version has export symbols, the Windows version exports by ordinal. The Mac version uses the PPC architecture making ...
- 137
2
votes
1
answer
896
views
PowerPC reversing finding the SDA and the TOC
For PowerPCs how do you find out the TOC address or the SDA address?
Like for example in this case.
- 105
1
vote
2
answers
3k
views
Set register to specific value for use in autoanalysis in IDA Pro 6.9
I'm using IDA Pro 6.9 with some PowerPC disassembly. The code sets up r13 to a value, say 0x10000, then offsets that register to load and store memory in that region. r13 is never modified again in ...
- 13
1
vote
1
answer
380
views
Append Code To Text Segment With Global Variables?
I have a powerpc computer that takes ELF files for its code. I have made a tool that allows me to extract and inject segments successfully, but I am missing a small piece of information regarding the ...
- 181
1
vote
1
answer
317
views
Can PowerPC64 ELF file have 32-bit pointers?
I've been given an ELF binary file which self describes as PowerPC 64-bit. The e_entry field of the ELF header points to the beginning of a section called .opd. According to this specification, it is ...
- 1,082
2
votes
2
answers
1k
views
Disassemble the Decompression method (PowerPC ASM)
Continues from Unknown game data compression method (Gamecube)
I have compression data which was start with: [ * SK_ASC* ] and unknown compression method.The list below compression method that I ...
- 43
1
vote
1
answer
690
views
Why does the PowerPC Compiler emit a clclr instruction before calling a function?
I disassemble my own written code in C to PowerPC assembly, and I can't understand why crclr occurrs before the call to the printf function.
C code
int main()
{
int a, b, c;
a = 10;
b ...
- 107