mirror of
https://codeberg.org/KeybadeBlox/JSRF-Decompilation.git
synced 2026-02-20 10:17:03 +03:00
137 lines
6.7 KiB
Markdown
137 lines
6.7 KiB
Markdown
# Getting Started
|
|
Anybody is welcome to contribute to the decompilation effort! There are two
|
|
main roles a contributor can fulfill:
|
|
|
|
- *Delinking*, which entails analyzing the JSRF executable in-situ to figure
|
|
out how to break it up into small chunks of code and data, and
|
|
- *Decompiling*, which is writing C++ code that compiles down to the same code
|
|
and data found in those chunks.
|
|
|
|
Of these two tasks, the latter is more accessible and benefits more from a
|
|
large group of volunteers, so we'll begin there. Those who want to participate
|
|
in the delinking effort can follow the decompilation guide and then continue on
|
|
to the delinking guide afterwards.
|
|
|
|
|
|
## Setting Up Decompilation
|
|
You'll need a few things to get a decompilation workflow ready:
|
|
|
|
- The JSRF executable (`default.xbe` in the root directory of the game disc) to
|
|
provide the target compiled code to match
|
|
- The Microsoft Visual C++ 7.0 (AKA Visual C++ .NET 2002) compiler to compile
|
|
your C++ code
|
|
- You'll also want to add its `Bin/` directory to your `PATH` so that objdiff
|
|
can find it
|
|
- The [Git](https://git-scm.com/) version control tool to clone and work on
|
|
this repository
|
|
- The [Ghidra](https://github.com/NationalSecurityAgency/ghidra) reverse
|
|
engineering tool to analyze and browse the executable
|
|
- The [XBE extension](https://github.com/XboxDev/ghidra-xbe) for Ghidra to
|
|
import and analyze the JSRF executable
|
|
- The [delinker extension](https://github.com/boricj/ghidra-delinker-extension)
|
|
for Ghidra to export object files from the executable
|
|
- The [objdiff](https://github.com/encounter/objdiff) code diffing tool to
|
|
compare your C++ code's compiled output to the delinked object files
|
|
|
|
Keep in mind that Ghidra and its extensions need to have their versions
|
|
coordinated. The safest thing to do is to get the same version of each, e.g.
|
|
11.4. The general flow for installing extensions is to download a release
|
|
`.zip` for the extension from the linked repository's releases page, open
|
|
Ghidra, open the `File > Install Extensions` menu, click the green plus at the
|
|
top right of the extensions window, and then select the `.zip` you just
|
|
downloaded. Make sure the box to the left of the extension's name is checked
|
|
to enable it before clicking "OK" to close the extensions window.
|
|
|
|
With all these tools acquired, the last thing to get is this repository. Clone
|
|
it with `git` in the usual fashion:
|
|
```
|
|
git clone https://codeberg.org/KeybadeBlox/JSRF-Decomp-Notes.git
|
|
```
|
|
|
|
The following sections detail how to use all these tools to start writing
|
|
decompiled code.
|
|
|
|
|
|
### Creating a JSRF Ghidra Project
|
|
Even if you have no intention of analyzing the executable in Ghidra otherwise,
|
|
Ghidra is needed to produce the object files that objdiff will compare your
|
|
recompiled code against. This section will only cover the steps needed to get
|
|
to that point.
|
|
|
|
Open Ghidra and create a new project (`File > New Project...`). Select the
|
|
"Non-Shared Project" option, and set whatever location and name you'd like.
|
|
With the project created, open the file import dialogue
|
|
(`File > Import File...`) and select the `default.xbe` from JSRF. Ensure that
|
|
the format in the next window is set to "Xbox Executable Format (XBE)" (if this
|
|
isn't an option, you need to install/enable the XBE extension), and that the
|
|
name is "default.xbe" (our tooling depends on it having this specific name).
|
|
Click "OK," and you should see a window with a successful import results
|
|
summary after a moment (you'll probably see the message
|
|
`[xboxkrnl.exe] -> not found in project`, but this is fine and expected).
|
|
|
|
`default.xbe` should now be visible in the file listing for the project.
|
|
Double click it to open it in the CodeBrowser. The window that opens is where
|
|
you'll do all your in-situ analysis, should you choose to do so. You'll be
|
|
asked whether you want to run analyzers, which is strongly recommended unless
|
|
you're certain you won't be using Ghidra for anything else. If you do run the
|
|
analyzers, simply clicking "Analyze" in the analysis options window without
|
|
changing anything is fine, and the analysis will probably take a couple
|
|
minutes.
|
|
|
|
Now we'll import symbols from the JSRF decompilation repository. After running
|
|
or skipping the analysis, open the script manager (`Window > Script Manager`)
|
|
and select the "Data" folder in the left pane. Double click the script titled
|
|
`ImportSymbolsScript.py`, and a file picker will open after a moment. Select
|
|
`symboltable.tsv` from the `delink/` directory of your cloned JSRF
|
|
decompilation repository, and you should see a bunch of `Created function...`
|
|
and `Created label...` in the scripting console window. Save your changes
|
|
(save icon in the top left of the CodeBrowser window), and your Ghidra project
|
|
should be all ready for creating object files for objdiff.
|
|
|
|
|
|
### Producing Object Files
|
|
Close all of your Ghidra windows and open a shell in the decompilation
|
|
repository's `delink/` directory. The `delink.sh` script is our automated tool
|
|
for extracting all the object files that have been identified so far. Invoke
|
|
it with three arguments:
|
|
|
|
- The path to your Ghidra installation (the directory with files like
|
|
`ghidraRun` and `ghidraRun.bat`, and directories like `docs/` and
|
|
`Extensions/`
|
|
- The path to your JSRF Ghidra project (the directory with a `.gpr` file and a
|
|
directory with a name ending in `.rep`)
|
|
- The name of your JSRF Ghidra project
|
|
|
|
There are two common errors you might get here:
|
|
|
|
- `Unable to lock project!`: This means that Ghidra isn't fully closed. Make
|
|
sure you've completely closed every Ghidra window before running `delink.sh`.
|
|
- `Script not found: DelinkProgram.java` and
|
|
`Invalid script: DelinkProgram.java`: This means that the Ghidra delinker
|
|
extension isn't properly installed. Ensure it's installed and enabled first.
|
|
|
|
If all goes well, you'll see the message `Delinking complete!` at the end of
|
|
the script's output, and the extracted object files will be in the
|
|
`decompile/target/` directory of the repository. Now we're ready to start
|
|
recompiling and diffing code with objdiff.
|
|
|
|
|
|
### Setting Up objdiff
|
|
Open the objdiff GUI program (by default named something like
|
|
`objdiff-os-arch`, e.g. `objdiff-windows-x86_64.exe`). Click "Settings" in the
|
|
left sidebar and then "Select" next to "Project directory" in the popup window.
|
|
In the file picker, select the `decompile/` directory in the JSRF decompilation
|
|
repository.
|
|
|
|
The sidebar will now have a listing of all the extracted object files. Click
|
|
on one, and you should see two panes: one on the left labelled "Target object"
|
|
that lists the contents of the extracted object file, and one on the right
|
|
listing the contents of the recompiled object file. If the right pane displays
|
|
an error like "program not found," the Visual C++ 7.0 compiler probably wasn't
|
|
correctly set up on your `PATH`.
|
|
|
|
|
|
### Using objdiff
|
|
|
|
|
|
## Contrbuting to Delinking
|