Post B9kSKbCW6MR3YHJzdY by jannem@fosstodon.org
(DIR) More posts by jannem@fosstodon.org
(DIR) Post #B9kPjcl990bHlLlDP6 by ariadne@social.treehouse.systems
0 likes, 0 repeats
ah yes, chocobo's dungeon 2 also has a buggy replayer:ERROR upse-ng.cc:86 [report_error]: upse-ng: render: PSF1 machine failure: PS1 BIOS HLE A0 call 0x39 (ra=0x800bc108, a0=0x800bc00c, a1=0x800bc104, a2=0x00000000, a3=0x00000000) failed: PS1 HLE guest address arithmetic overflow:(
(DIR) Post #B9kPrCGvVXh1vjEiYK by ariadne@social.treehouse.systems
0 likes, 0 repeats
(it is passing a pointer address instead of an int to InitHeap())
(DIR) Post #B9kQI5wj8QdE86c8e0 by ariadne@social.treehouse.systems
0 likes, 0 repeats
hmm, but why is a pointer in $a0?see, this is why i hate delay slots
(DIR) Post #B9kQV4mykU9QIzFDiC by ariadne@social.treehouse.systems
0 likes, 0 repeats
hmm, this replayer seems to have some sort of code obfuscation because it uses self-modifying codefucking ugh
(DIR) Post #B9kQZrl8cW9PLHfRZo by ariadne@social.treehouse.systems
0 likes, 0 repeats
antipiracy code, i guess? maybe we can just nop it out?
(DIR) Post #B9kQuZsIJGnzxItHzk by ariadne@social.treehouse.systems
0 likes, 1 repeats
nasty. the antipiracy code uses an undocumented CPU bug on the playstation's r3000 MIPS core to detect if it is running under emulation. incredible...
(DIR) Post #B9kR1qk3zpCKINVaHQ by thomrstrom@triangletoot.party
0 likes, 0 repeats
@ariadne I mean, wouldn't you do that if you were the implementer?
(DIR) Post #B9kR6RkyJoGaFj7plQ by ariadne@social.treehouse.systems
0 likes, 0 repeats
@thomrstrom that *does* seem like something i would do 🙃
(DIR) Post #B9kREZByYbjzd8d0Bk by thomrstrom@triangletoot.party
0 likes, 0 repeats
@ariadne Two areas I'm glad to have never worked in my life: Advertising and Anti-Piracy.
(DIR) Post #B9kRUHQWNO6rAIvN5M by ariadne@social.treehouse.systems
0 likes, 0 repeats
okay, r3000 errata has been implemented. yuck.
(DIR) Post #B9kRXxQkfDleJ2mm6C by ariadne@social.treehouse.systems
0 likes, 0 repeats
@thomrstrom sure, but i guess my question is -- why didn't the ripper just delete the antipiracy code when extracting the replayer
(DIR) Post #B9kRz1XrTQUct11996 by cr1901@mastodon.social
0 likes, 0 repeats
@ariadne (I only did one search) Where can I learn more about this specific bug?
(DIR) Post #B9kS76G7pazVp5ZYYa by ariadne@social.treehouse.systems
0 likes, 0 repeats
@cr1901 you are asking me to provide you with documentation for an undocumented CPU bug relating to the delay slot?are you serious?i just figured it out using ghidra man...
(DIR) Post #B9kS9UFBcwBAn2Gtdo by ariadne@social.treehouse.systems
0 likes, 0 repeats
@cr1901 but if you're interested, upse-ng latest commit has the deets
(DIR) Post #B9kSKbCW6MR3YHJzdY by jannem@fosstodon.org
0 likes, 0 repeats
@ariadne So they were potentially one mid-production hardware revision away from making it unplayable on genuine consoles. On a platform without a way to distribute a patch. Doesn't strike me as a great business decision, even if they got away with it this time.
(DIR) Post #B9kSb8RWHCTPHdDwpM by ariadne@social.treehouse.systems
0 likes, 0 repeats
@jannem i mean, the code in question is taking advantage of undefined behavior, basically.
(DIR) Post #B9kT2yHFfJoprbh7S4 by jannem@fosstodon.org
0 likes, 0 repeats
@ariadne Yep. But unlike PC or mobile platforms they'd have no path to fix it for unhappy customers if it breaks.
(DIR) Post #B9kT5NUsryFyf2Dbt2 by cr1901@mastodon.social
0 likes, 0 repeats
@ariadne Will take a look. I've heard of a few PS1 CPU bugs where certain insns interact rather badly with the load delay slot. But since the CPU doesn't go into the weeds in your case, guessing this is not one of those bugs I previously heard about.
(DIR) Post #B9kTKGZOuHIfWKQkZU by ariadne@social.treehouse.systems
0 likes, 0 repeats
@cr1901 anyway the tl;dr isif you have MIPS assembly like such:loop: lw s0, 0(a0) lw s1, 0(a1) xor s0, s0, s1 sw s0, 0(a1) addiu a0, a0, 4 addiu a1, a1, 4 sltu v0, a1, v1 bne v0, zero, loop j nested_exit # inner delay slot candidate nop # outer delay slot candidatenested_exit: ...then, without this erratum in the implementation, instead of returning to loop, the antipiracy code jumps to nested_exit instead of returning to the head of the loop.like i said, it is nasty.
(DIR) Post #B9kTqIw5e5Uo7oJufA by ariadne@social.treehouse.systems
0 likes, 0 repeats
ah, it seems that this block of code is not antipiracy code, but some sort of obfuscation attempt that, again, abuses a CPU erratum
(DIR) Post #B9kU6oVa1mjWg7nCVc by ariadne@social.treehouse.systems
0 likes, 0 repeats
*grumbles loudly about scene assholes*
(DIR) Post #B9kUKBv6IMiz3L6msi by ariadne@social.treehouse.systems
0 likes, 0 repeats
like if you are going to protect your crack, could you at least do so without abusing undefined behavior?
(DIR) Post #B9kUUxsipVjghP8Juq by whitequark@social.treehouse.systems
0 likes, 0 repeats
@ariadne i mean... that would make the protection worse...
(DIR) Post #B9kUaWG0RwlAlEfly4 by ariadne@social.treehouse.systems
0 likes, 0 repeats
@whitequark yes, but in this case, the xor material was literally a credits string from the ripper :|
(DIR) Post #B9kYDeqSklWMYJ4yeG by ariadne@social.treehouse.systems
0 likes, 0 repeats
@dalias @cr1901 its basically a while (!not_at_end) {...} loop.basically, it deobfuscates some code and jumps to it
(DIR) Post #B9kdRRcPE5UTM5tiLY by cr1901@mastodon.social
0 likes, 0 repeats
@ariadne @dalias > deobfuscatesAhh, that's what the XOR is doing?
(DIR) Post #B9kgtcFVawKAISJQkC by ariadne@social.treehouse.systems
0 likes, 0 repeats
@cr1901 @dalias yes, there is an obfuscated code sequence that wraps the game code (to make it function as a standalone replayer) that is obfuscated against an attribution notice.my guess is that the author of that code sequence intentionally abused this CPU erratum in order to make deobfuscation more difficult
(DIR) Post #B9ktUnnUowYIHFhxPE by oblomov@sociale.network
0 likes, 0 repeats
@ariadne @whitequark «at least use it on an interesting part of the code»
(DIR) Post #B9l2g2jYWispNIIef2 by colinstu@birdbutt.com
0 likes, 0 repeats
@ariadne scene devs: