GhidraRPXLoader icon indicating copy to clipboard operation
GhidraRPXLoader copied to clipboard

Lego Games RPX not loading properly

Open bloodmc opened this issue 6 years ago • 5 comments

On Ghidra 9.0.2, the following errors occur when attempting to open the Lego Dimensions RPX

https://gist.githubusercontent.com/bloodmc/a116141e7486d7fca8a738c02ee43b4e/raw/78f5d6aa00ee5fc93908a327298a80f8db9c37a0/ghidra_lego_rpx.txt

This causes all code to show up with ??.

From what I was told, Lego Dimensions uses some odd wrappers causing various RPX loaders to not work fully.

bloodmc avatar May 17 '19 02:05 bloodmc

@Maschell Any idea on this issue? If you need more information let me know.

Thanks!

Dug a bit further, the error's are coming from Ghidra's ELF loader.

https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/ElfProgramBuilder.java#L704

https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Features/Base/src/main/java/ghidra/app/util/opinion/ElfProgramBuilder.java#L1273

bloodmc avatar May 19 '19 13:05 bloodmc

@NWPlayer123 Sorry to ping you here but I see you have dealt with various ELF/RPL/RPX tools on your github and was wondering if you would be able to chime in on the above issue?

bloodmc avatar May 19 '19 18:05 bloodmc

Do you have a hash of the RPX you were using?

Maschell avatar May 19 '19 18:05 Maschell

I'm using the latest Lego Dimensions update (v320) RPX.

File: zeus.master.rpx
CRC-32: 0465374c
   MD4: fbb209c297f547c46ef7b68f92e1f90e
   MD5: fcf2e16280c8fea7b27ac7201108dcf9
 SHA-1: 1a9ef44c44e6b0769674180920a795efdcf4521e

bloodmc avatar May 19 '19 18:05 bloodmc

Update: If I decompress the RPX file, it partially works. Here are the steps I used

  1. Download wiiurpxtool from https://github.com/0CBH0/wiiurpxtool/releases
  2. Execute the following command wiiurpxtool -d zeus.master.rpx zeus.decompressed.rpx
  3. Import zeus.decompressed.rpx into Ghidra and it partially works. Note: This mostly works but I get many Bad instruction: Unable to resolve constructor at addr errors. This causes sections with errors to show up as ??

bloodmc avatar May 19 '19 22:05 bloodmc