Crunching/Compression/Packed?

[-MIPs-]

Hey all, found a link to this site over at CMP boards. I've been browsing through and its looks like this forum is another information mine for me. *bookmarked*

The lastest developments by misfire have caught my attention though. I was wondering where could I find out more about crunching/uncruching elf files, and how to tell if an elf is crunched/compressed/packed. It might possibly be related to what I'm working on, which is making codes for Phantasy Star Universe. The elf file isn't of much use and I havn't been able to load it far enough in pcsx2 to get a good dump. Also it uses Libmc2 so save and live dump codes are a no go. I don't no where to go from here

[Lazy Bastard]

Could you upload the ELF? We could probably determine how it's compressed. That way PS2Dis would be a little more useful.

[-MIPs-]

Could you upload the ELF? We could probably determine how it's compressed. That way PS2Dis would be a little more useful.

Sure thing....I tried posting it before I left for work but it kept giving me an error. But I'll get up soon as I get in the morning.

[LiquidManZero]

Might be the size limit. If it's over 4 MB, it won't work, and it's not really possible to change that...

[-MIPs-]

Ok here we go....

This is PSU_US.ERX: This file looks like what most slus/sles files usually look like on game discs. I'm assuming this could be the actual in-game code because of the labels in it.

http://www.megaupload.com/?d=LFFABGR4

This is the SLUS file: The labels in this are mostly all related to networking. Very short file. My assuption is that this is main() and it probably loads PSU_US.ERX from within. It would make sense because this game has completely seperate online and offline modes.

http://www.megaupload.com/?d=L7TVJG2S

[Lazy Bastard]

Cool; I grabbed those. I'll take a look.

When something is crunched via most compression methods I've seen, you'll find very few labels with PS2Dis. There are also a couple of weird compressions, like that/those used in the Codebreaker ELFs.

Anyway, back to work.

[Edit]: These don't seem to be conventionally crunched, in any case. I don't know if anything's been intentionally hidden from us, but it doesn't seem like it.

[-MIPs-]

Cool; I grabbed those. I'll take a look.

When something is crunched via most compression methods I've seen, you'll find very few labels with PS2Dis. There are also a couple of weird compressions, like that/those used in the Codebreaker ELFs.

Anyway, back to work.

[Edit]: These don't seem to be conventionally crunched, in any case. I don't know if anything's been intentionally hidden from us, but it doesn't seem like it.

Yea, after I read your explanation and found that second file, I can see that it's more than likely not. I've found that in the PSU_US file there are ALOT of labels that seem to deal with online aspects of the game. They start with "T".

TGamePlayer::RcvPlayerItemAddDel >%s
TGamePlayer::SetItemEquip>%s(%d,%d,%d,%x) Probably packets....

*EDIT* O yea, Also since this file loads into ps2dis at starting address 00000000 by default, is it safe to assume that thats where it will be in memory. I gotta start testing some things in single player. Multiplayer is safe because of DNAS (for now....*evil grin*)

[Lazy Bastard]

*EDIT* O yea, Also since this file loads into ps2dis at starting address 00000000 by default, is it safe to assume that thats where it will be in memory.

Addresses in PS2Dis are representative of actual addresses in memory, so not always, but for the most part, yes.

[-MIPs-]

Then this file must completely take over at some point. Its 8mb so it would completely overwrite the slus file in memory. Hmmmm.....

[cYs Driver]

oh just to let you know that it wont actually start at 0x00000000 i dont think as that's kernel memory so im guessing that file is read into memory (not as an elf)

[Lazy Bastard]

Hmm...does the SYSTEM.CNF reference the ERX or SLUS?

[cYs Driver]

the system.cnf generally has the path to the scus but the scus may be just a small loader to load other files

[Lazy Bastard]

Heh, I know...I mean in this instance.

[-MIPs-]

Hmm...does the SYSTEM.CNF reference the ERX or SLUS?

It references the SLUS......

cYs Driver - *the system.cnf generally has the path to the scus but the scus may be just a small loader to load other files*

If thats the case then is there a way to find out where in memory it's being loaded. Or can we assume it starts at the end of the SLUS

Also these 3 huge files are in the root dir:

PSUROFS.CVM - 3gig

CDPSU0.AFS - ~500mb

CDPSU1.AFS - ~400mb

[cYs Driver]

there aboviusly encrypted files.
to the other question yes you can open the scus and search for the name of the file its loading as a string it might be "cdrom0:...." or "host:"
from there follow it find the file reading function and find the address passed to it