Yagi icon indicating copy to clipboard operation
Yagi copied to clipboard

[Yagi] ERROR : No sleigh specification for PowerPC:BE:16:default

Open p0358 opened this issue 2 years ago • 1 comments

This happens when Yagi is attempted to be used with a xex file from Xbox 360:

[Yagi] INFO :  load compiler with sleigh id : PowerPC:BE:16:default
[Yagi] ERROR :  No sleigh specification for PowerPC:BE:16:default

The file is loaded into IDA using this loader: https://github.com/emoose/idaxex

Would appreciate a fix since PowerPC is declared to be supported, so it's probably something simple, thanks in advance

EDIT:

Full output:

WARNING: Python 3 is not configured (Python3TargetDLL value is not set). Please run idapyswitch to select a Python 3 install.

  bytes   pages size description
--------- ----- ---- --------------------------------------------
112492544 13732 8192 allocating memory for b-tree...
103317504 12612 8192 allocating memory for virtual array...
   262144    32 8192 allocating memory for name pointers...
-----------------------------------------------------------------
216072192            total memory allocated

Loading processor module C:\Program Files\IDA Pro 7.6\procs\ppc64.dll for PPC...Initializing processor module PPC...OK
Loading type libraries...
Autoanalysis subsystem has been initialized.
Database for file 'output.xex' has been loaded.
[Yagi] INFO :  load compiler with sleigh id : PowerPC:BE:16:default
[Yagi] ERROR :  No sleigh specification for PowerPC:BE:16:default
---------------------------------------------------------------------------------------------
Python 3.10.1 (tags/v3.10.1:2cd268a, Dec  6 2021, 19:10:37) [MSC v.1929 64 bit (AMD64)] 
IDAPython 64-bit v7.4.0 final (serial 0) (c) The IDAPython Team <[email protected]>
---------------------------------------------------------------------------------------------

IDA version: v7.6

Additional info from IDA View:

.rdata:82000600 Imports from xam.xex v2.0.21256.0 (minimum v2.0.16537.0)
.rdata:82000600
.rdata:82000600
.rdata:82000600 # Processor       : PPC
.rdata:82000600 # Target assembler: GNU Assembler
.rdata:82000600 # Byte sex        : Big endian
.rdata:82000600 # SIMD Instructions: VMX128
.rdata:82000600 # Processor Profile: Server
.rdata:82000600 # ABI              : sysv-hard_float
.rdata:82000600
.rdata:82000600 #include "ppc-asm.h"
.rdata:82000600 .set r1, 1; .set r2, 2
.rdata:82000600 .set lt, 0; .set gt, 1; .set eq, 2; .set so, 3

p0358 avatar Jan 31 '22 10:01 p0358

Apparently this is a problem with using IDA64 for a 32-bit file. When using IDA (32-bit), the file gets detected with

[Yagi] INFO :  load compiler with sleigh id : PowerPC:BE:32:default

and Yagi seems to work. The reason I loaded IDA64 was that my 32-bit installation was broken, but I fixed that problem for now.

So I guess my issue is solved, but not sure if I should close this? I guess the decision depends on whether IDA64 and Yagi are supposed to work with a 32-bit executable. I know for example Hex-Rays refuses to decompile on such configuration for x86 architectures. It might even be a problem with idaxex, in which case it wouldn't be relevant here in the first place.

p0358 avatar Jan 31 '22 10:01 p0358