# Copyright 2017 Reswitched Team # # Permission to use, copy, modify, and/or distribute this software for any purpose with or # without fee is hereby granted, provided that the above copyright notice and this permission # notice appear in all copies. # # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS # SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL # THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY # DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF # CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE # OR PERFORMANCE OF THIS SOFTWARE. # nxo64.py: IDA loader (and library for reading nso/nro files) from __future__ import print_function import gzip, math, os, re, struct, sys from struct import unpack as up, pack as pk from io import BytesIO import lz4.block uncompress = lz4.block.decompress if sys.version_info[0] == 3: iter_range = range int_types = (int,) ascii_string = lambda b: b.decode('ascii') bytes_to_list = lambda b: list(b) list_to_bytes = lambda l: bytes(l) else: iter_range = xrange int_types = (int, long) ascii_string = lambda b: str(b) bytes_to_list = lambda b: map(ord, b) list_to_bytes = lambda l: ''.join(map(chr, l)) def kip1_blz_decompress(compressed): compressed_size, init_index, uncompressed_addl_size = struct.unpack('<III', compressed[-0xC:]) decompressed = compressed[:] + b'\x00' * uncompressed_addl_size decompressed_size = len(decompressed) if len(compressed) != compressed_size: assert len(compressed) > compressed_size compressed = compressed[len(compressed) - compressed_size:] if not (compressed_size + uncompressed_addl_size): return b'' compressed = bytes_to_list(compressed) decompressed = bytes_to_list(decompressed) index = compressed_size - init_index outindex = decompressed_size while outindex > 0: index -= 1 control = compressed[index] for i in iter_range(8): if control & 0x80: if index < 2: raise ValueError('Compression out of bounds!') index -= 2 segmentoffset = compressed[index] | (compressed[index+1] << 8) segmentsize = ((segmentoffset >> 12) & 0xF) + 3 segmentoffset &= 0x0FFF segmentoffset += 2 if outindex < segmentsize: raise ValueError('Compression out of bounds!') for j in iter_range(segmentsize): if outindex + segmentoffset >= decompressed_size: raise ValueError('Compression out of bounds!') data = decompressed[outindex+segmentoffset] outindex -= 1 decompressed[outindex] = data else: if outindex < 1: raise ValueError('Compression out of bounds!') outindex -= 1 index -= 1 decompressed[outindex] = compressed[index] control <<= 1 control &= 0xFF if not outindex: break return list_to_bytes(decompressed) class BinFile(object): def __init__(self, li): self._f = li def read(self, arg): if isinstance(arg, str): fmt = '<' + arg size = struct.calcsize(fmt) raw = self._f.read(size) out = struct.unpack(fmt, raw) if len(out) == 1: return out[0] return out elif arg is None: return self._f.read() else: out = self._f.read(arg) return out def read_from(self, arg, offset): old = self.tell() try: self.seek(offset) out = self.read(arg) finally: self.seek(old) return out def seek(self, off): self._f.seek(off) def close(self): self._f.close() def tell(self): return self._f.tell() (DT_NULL, DT_NEEDED, DT_PLTRELSZ, DT_PLTGOT, DT_HASH, DT_STRTAB, DT_SYMTAB, DT_RELA, DT_RELASZ, DT_RELAENT, DT_STRSZ, DT_SYMENT, DT_INIT, DT_FINI, DT_SONAME, DT_RPATH, DT_SYMBOLIC, DT_REL, DT_RELSZ, DT_RELENT, DT_PLTREL, DT_DEBUG, DT_TEXTREL, DT_JMPREL, DT_BIND_NOW, DT_INIT_ARRAY, DT_FINI_ARRAY, DT_INIT_ARRAYSZ, DT_FINI_ARRAYSZ, DT_RUNPATH, DT_FLAGS) = iter_range(31) DT_GNU_HASH = 0x6ffffef5 DT_VERSYM = 0x6ffffff0 DT_RELACOUNT = 0x6ffffff9 DT_RELCOUNT = 0x6ffffffa DT_FLAGS_1 = 0x6ffffffb DT_VERDEF = 0x6ffffffc DT_VERDEFNUM = 0x6ffffffd STT_NOTYPE = 0 STT_OBJECT = 1 STT_FUNC = 2 STT_SECTION = 3 STB_LOCAL = 0 STB_GLOBAL = 1 STB_WEAK = 2 R_ARM_ABS32 = 2 R_ARM_TLS_DESC = 13 R_ARM_GLOB_DAT = 21 R_ARM_JUMP_SLOT = 22 R_ARM_RELATIVE = 23 R_AARCH64_ABS64 = 257 R_AARCH64_GLOB_DAT = 1025 R_AARCH64_JUMP_SLOT = 1026 R_AARCH64_RELATIVE = 1027 R_AARCH64_TLSDESC = 1031 MULTIPLE_DTS = set([DT_NEEDED]) class Range(object): def __init__(self, start, size): self.start = start self.size = size self.end = start+size self._inclend = start+size-1 def overlaps(self, other): return self.start <= other._inclend and other.start <= self._inclend def includes(self, other): return other.start >= self.start and other._inclend <= self._inclend def __repr__(self): return 'Range(0x%X -> 0x%X)' % (self.start, self.end) class Segment(object): def __init__(self, r, name, kind): self.range = r self.name = name self.kind = kind self.sections = [] def add_section(self, s): for i in self.sections: assert not i.range.overlaps(s.range), '%r overlaps %r' % (s, i) self.sections.append(s) class Section(object): def __init__(self, r, name): self.range = r self.name = name def __repr__(self): return 'Section(%r, %r)' % (self.range, self.name) def suffixed_name(name, suffix): if suffix == 0: return name return '%s.%d' % (name, suffix) class SegmentBuilder(object): def __init__(self): self.segments = [] def add_segment(self, start, size, name, kind): r = Range(start, size) for i in self.segments: assert not r.overlaps(i.range) self.segments.append(Segment(r, name, kind)) def add_section(self, name, start, end=None, size=None): assert end is None or size is None if size == 0: return if size is None: size = end-start assert size > 0 r = Range(start, size) for i in self.segments: if i.range.includes(r): i.add_section(Section(r, name)) return assert False, "no containing segment for %r" % (name,) def flatten(self): self.segments.sort(key=lambda s: s.range.start) parts = [] for segment in self.segments: suffix = 0 segment.sections.sort(key=lambda s: s.range.start) pos = segment.range.start for section in segment.sections: if pos < section.range.start: parts.append((pos, section.range.start, suffixed_name(segment.name, suffix), segment.kind)) suffix += 1 pos = section.range.start parts.append((section.range.start, section.range.end, section.name, segment.kind)) pos = section.range.end if pos < segment.range.end: parts.append((pos, segment.range.end, suffixed_name(segment.name, suffix), segment.kind)) suffix += 1 pos = segment.range.end return parts class ElfSym(object): def __init__(self, name, info, other, shndx, value, size): self.name = name self.shndx = shndx self.value = value self.size = size self.vis = other & 3 self.type = info & 0xF self.bind = info >> 4 def __repr__(self): return 'Sym(name=%r, shndx=0x%X, value=0x%X, size=0x%X, vis=%r, type=%r, bind=%r)' % ( self.name, self.shndx, self.value, self.size, self.vis, self.type, self.bind) class NxoFileBase(object): # segment = (content, file offset, vaddr, vsize) def __init__(self, text, ro, data, bsssize): self.text = text self.ro = ro self.data = data self.bsssize = bsssize self.textoff = text[2] self.textsize = text[3] self.rodataoff = ro[2] self.rodatasize = ro[3] self.dataoff = data[2] flatsize = data[2] + data[3] full = text[0] if ro[2] >= len(full): full += b'\x00' * (ro[2] - len(full)) else: print('truncating .text?') full = full[:ro[2]] full += ro[0] if data[2] > len(full): full += b'\x00' * (data[2] - len(full)) else: print('truncating .rodata?') full += data[0] f = BinFile(BytesIO(full)) self.binfile = f # read MOD self.modoff = f.read_from('I', 4) f.seek(self.modoff) if f.read('4s') != b'MOD0': raise NxoException('invalid MOD0 magic') self.dynamicoff = self.modoff + f.read('i') self.bssoff = self.modoff + f.read('i') self.bssend = self.modoff + f.read('i') self.unwindoff = self.modoff + f.read('i') self.unwindend = self.modoff + f.read('i') self.moduleoff = self.modoff + f.read('i') self.datasize = self.bssoff - self.dataoff self.bsssize = self.bssend - self.bssoff self.isLibnx = False if f.read('4s') == 'LNY0': self.isLibnx = True self.libnx_got_start = self.modoff + f.read('i') self.libnx_got_end = self.modoff + f.read('i') self.segment_builder = builder = SegmentBuilder() for off,sz,name,kind in [ (self.textoff, self.textsize, ".text", "CODE"), (self.rodataoff, self.rodatasize, ".rodata", "CONST"), (self.dataoff, self.datasize, ".data", "DATA"), (self.bssoff, self.bsssize, ".bss", "BSS"), ]: builder.add_segment(off, sz, name, kind) # read dynamic self.armv7 = (f.read_from('Q', self.dynamicoff) > 0xFFFFFFFF or f.read_from('Q', self.dynamicoff+0x10) > 0xFFFFFFFF) self.offsize = 4 if self.armv7 else 8 f.seek(self.dynamicoff) self.dynamic = dynamic = {} for i in MULTIPLE_DTS: dynamic[i] = [] for i in iter_range((flatsize - self.dynamicoff) // 0x10): tag, val = f.read('II' if self.armv7 else 'QQ') if tag == DT_NULL: break if tag in MULTIPLE_DTS: dynamic[tag].append(val) else: dynamic[tag] = val builder.add_section('.dynamic', self.dynamicoff, end=f.tell()) # read .dynstr if DT_STRTAB in dynamic and DT_STRSZ in dynamic: f.seek(dynamic[DT_STRTAB]) self.dynstr = f.read(dynamic[DT_STRSZ]) else: self.dynstr = b'\x00' print('warning: no dynstr') for startkey, szkey, name in [ (DT_STRTAB, DT_STRSZ, '.dynstr'), (DT_INIT_ARRAY, DT_INIT_ARRAYSZ, '.init_array'), (DT_FINI_ARRAY, DT_FINI_ARRAYSZ, '.fini_array'), (DT_RELA, DT_RELASZ, '.rela.dyn'), (DT_REL, DT_RELSZ, '.rel.dyn'), (DT_JMPREL, DT_PLTRELSZ, ('.rel.plt' if self.armv7 else '.rela.plt')), ]: if startkey in dynamic and szkey in dynamic: builder.add_section(name, dynamic[startkey], size=dynamic[szkey]) self.needed = [self.get_dynstr(i) for i in self.dynamic[DT_NEEDED]] # load .dynsym self.symbols = symbols = [] if DT_SYMTAB in dynamic and DT_STRTAB in dynamic: f.seek(dynamic[DT_SYMTAB]) while True: if dynamic[DT_SYMTAB] < dynamic[DT_STRTAB] and f.tell() >= dynamic[DT_STRTAB]: break if self.armv7: st_name, st_value, st_size, st_info, st_other, st_shndx = f.read('IIIBBH') else: st_name, st_info, st_other, st_shndx, st_value, st_size = f.read('IBBHQQ') if st_name > len(self.dynstr): break symbols.append(ElfSym(self.get_dynstr(st_name), st_info, st_other, st_shndx, st_value, st_size)) builder.add_section('.dynsym', dynamic[DT_SYMTAB], end=f.tell()) self.plt_entries = [] self.relocations = [] locations = set() plt_got_end = None if DT_REL in dynamic and DT_RELSZ in dynamic: locations |= self.process_relocations(f, symbols, dynamic[DT_REL], dynamic[DT_RELSZ]) if DT_RELA in dynamic and DT_RELASZ in dynamic: locations |= self.process_relocations(f, symbols, dynamic[DT_RELA], dynamic[DT_RELASZ]) if DT_JMPREL in dynamic and DT_PLTRELSZ in dynamic: pltlocations = self.process_relocations(f, symbols, dynamic[DT_JMPREL], dynamic[DT_PLTRELSZ]) locations |= pltlocations plt_got_start = min(pltlocations) plt_got_end = max(pltlocations) + self.offsize if DT_PLTGOT in dynamic: builder.add_section('.got.plt', dynamic[DT_PLTGOT], end=plt_got_end) if not self.armv7: f.seek(0) text = f.read(self.textsize) last = 12 while True: pos = text.find(struct.pack('<I', 0xD61F0220), last) if pos == -1: break last = pos+1 if (pos % 4) != 0: continue off = pos - 12 a, b, c, d = struct.unpack_from('<IIII', text, off) if d == 0xD61F0220 and (a & 0x9f00001f) == 0x90000010 and (b & 0xffe003ff) == 0xf9400211: base = off & ~0xFFF immhi = (a >> 5) & 0x7ffff immlo = (a >> 29) & 3 paddr = base + ((immlo << 12) | (immhi << 14)) poff = ((b >> 10) & 0xfff) << 3 target = paddr + poff if plt_got_start <= target < plt_got_end: self.plt_entries.append((off, target)) builder.add_section('.plt', min(self.plt_entries)[0], end=max(self.plt_entries)[0] + 0x10) # try to find the ".got" which should follow the ".got.plt" if not self.isLibnx: if plt_got_end is not None: good = False got_end = plt_got_end + self.offsize while got_end in locations and (DT_INIT_ARRAY not in dynamic or got_end < dynamic[DT_INIT_ARRAY]): good = True got_end += self.offsize if good: builder.add_section('.got', plt_got_end, end=got_end) if self.isLibnx: builder.add_section('.got', self.libnx_got_start, end=self.libnx_got_end) self.sections = [] for start, end, name, kind in builder.flatten(): self.sections.append((start, end, name, kind)) def process_relocations(self, f, symbols, offset, size): locations = set() f.seek(offset) relocsize = 8 if self.armv7 else 0x18 for i in iter_range(size // relocsize): # NOTE: currently assumes all armv7 relocs have no addends, # and all 64-bit ones do. if self.armv7: offset, info = f.read('II') addend = None r_type = info & 0xff r_sym = info >> 8 else: offset, info, addend = f.read('QQq') r_type = info & 0xffffffff r_sym = info >> 32 sym = symbols[r_sym] if r_sym != 0 else None if r_type != R_AARCH64_TLSDESC and r_type != R_ARM_TLS_DESC: locations.add(offset) self.relocations.append((offset, r_type, sym, addend)) return locations def get_dynstr(self, o): return ascii_string(self.dynstr[o:self.dynstr.index(b'\x00', o)]) class NsoFile(NxoFileBase): def __init__(self, fileobj): f = BinFile(fileobj) if f.read_from('4s', 0) != b'NSO0': raise NxoException('Invalid NSO magic') flags = f.read_from('I', 0xC) toff, tloc, tsize = f.read_from('III', 0x10) roff, rloc, rsize = f.read_from('III', 0x20) doff, dloc, dsize = f.read_from('III', 0x30) tfilesize, rfilesize, dfilesize = f.read_from('III', 0x60) bsssize = f.read_from('I', 0x3C) #print('load text: ') text = (uncompress(f.read_from(tfilesize, toff), uncompressed_size=tsize), None, tloc, tsize) if flags & 1 else (f.read_from(tfilesize, toff), toff, tloc, tsize) ro = (uncompress(f.read_from(rfilesize, roff), uncompressed_size=rsize), None, rloc, rsize) if flags & 2 else (f.read_from(rfilesize, roff), roff, rloc, rsize) data = (uncompress(f.read_from(dfilesize, doff), uncompressed_size=dsize), None, dloc, dsize) if flags & 4 else (f.read_from(dfilesize, doff), doff, dloc, dsize) super(NsoFile, self).__init__(text, ro, data, bsssize) class NroFile(NxoFileBase): def __init__(self, fileobj): f = BinFile(fileobj) if f.read_from('4s', 0x10) != b'NRO0': raise NxoException('Invalid NRO magic') f.seek(0x20) tloc, tsize = f.read('II') rloc, rsize = f.read('II') dloc, dsize = f.read('II') bsssize = f.read_from('I', 0x28) text = (f.read_from(tsize, tloc), tloc, tloc, tsize) ro = (f.read_from(rsize, rloc), rloc, rloc, rsize) data = (f.read_from(dsize, dloc), dloc, dloc, dsize) super(NroFile, self).__init__(text, ro, data, bsssize) class KipFile(NxoFileBase): def __init__(self, fileobj): f = BinFile(fileobj) if f.read_from('4s', 0) != b'KIP1': raise NxoException('Invalid KIP magic') flags = f.read_from('b', 0x1F) tloc, tsize, tfilesize = f.read_from('III', 0x20) rloc, rsize, rfilesize = f.read_from('III', 0x30) dloc, dsize, dfilesize = f.read_from('III', 0x40) toff = 0x100 roff = toff + tfilesize doff = roff + rfilesize bsssize = f.read_from('I', 0x54) print('bss size 0x%x' % bsssize) print('load segments') text = (kip1_blz_decompress(f.read_from(tfilesize, toff)), None, tloc, tsize) if flags & 1 else (f.read_from(tfilesize, toff), toff, tloc, tsize) ro = (kip1_blz_decompress(f.read_from(rfilesize, roff)), None, rloc, rsize) if flags & 2 else (f.read_from(rfilesize, roff), roff, rloc, rsize) data = (kip1_blz_decompress(f.read_from(dfilesize, doff)), None, dloc, dsize) if flags & 4 else (f.read_from(dfilesize, doff), doff, dloc, dsize) super(KipFile, self).__init__(text, ro, data, bsssize) class NxoException(Exception): pass def load_nxo(fileobj): fileobj.seek(0) header = fileobj.read(0x14) if header[:4] == b'NSO0': return NsoFile(fileobj) elif header[0x10:0x14] == b'NRO0': return NroFile(fileobj) elif header[:4] == b'KIP1': return KipFile(fileobj) else: raise NxoException("not an NRO or NSO or KIP file") try: import idaapi import idc except ImportError: pass else: # IDA specific code def accept_file(li, n): print('accept_file') if not isinstance(n, int_types) or n == 0: li.seek(0) if li.read(4) == b'NSO0': return 'nxo.py: Switch binary (NSO)' li.seek(0) if li.read(4) == b'KIP1': return 'nxo.py: Switch binary (KIP)' li.seek(0x10) if li.read(4) == b'NRO0': return 'nxo.py: Switch binary (NRO)' return 0 def ida_make_offset(f, ea): if f.armv7: idaapi.create_data(ea, idc.FF_DWORD, 4, idaapi.BADADDR) else: idaapi.create_data(ea, idc.FF_QWORD, 8, idaapi.BADADDR) idc.op_plain_offset(ea, 0, 0) def find_bl_targets(text_start, text_end): targets = set() for pc in range(text_start, text_end, 4): d = idc.get_wide_dword(pc) if (d & 0xfc000000) == 0x94000000: imm = d & 0x3ffffff if imm & 0x2000000: imm |= ~0x1ffffff if 0 <= imm <= 2: continue target = pc + imm * 4 if target >= text_start and target < text_end: targets.add(target) return targets def load_file(li, neflags, format): idaapi.set_processor_type("arm", idaapi.SETPROC_LOADER_NON_FATAL|idaapi.SETPROC_LOADER) f = load_nxo(li) if f.armv7: idc.set_inf_attr(idc.INF_LFLAGS, idc.get_inf_attr(idc.INF_LFLAGS) | idc.LFLG_PC_FLAT) else: idc.set_inf_attr(idc.INF_LFLAGS, idc.get_inf_attr(idc.INF_LFLAGS) | idc.LFLG_64BIT) idc.set_inf_attr(idc.INF_DEMNAMES, idaapi.DEMNAM_GCC3) idaapi.set_compiler_id(idaapi.COMP_GNU) idaapi.add_til('gnulnx_arm' if f.armv7 else 'gnulnx_arm64', 1) loadbase = 0x60000000 if f.armv7 else 0x7100000000 f.binfile.seek(0) as_string = f.binfile.read(f.bssoff) idaapi.mem2base(as_string, loadbase) if f.text[1] != None: li.file2base(f.text[1], loadbase + f.text[2], loadbase + f.text[2] + f.text[3], True) if f.ro[1] != None: li.file2base(f.ro[1], loadbase + f.ro[2], loadbase + f.ro[2] + f.ro[3], True) if f.data[1] != None: li.file2base(f.data[1], loadbase + f.data[2], loadbase + f.data[2] + f.data[3], True) for start, end, name, kind in f.sections: if name.startswith('.got'): kind = 'CONST' idaapi.add_segm(0, loadbase+start, loadbase+end, name, kind) segm = idaapi.get_segm_by_name(name) if kind == 'CONST': segm.perm = idaapi.SEGPERM_READ elif kind == 'CODE': segm.perm = idaapi.SEGPERM_READ | idaapi.SEGPERM_EXEC elif kind == 'DATA': segm.perm = idaapi.SEGPERM_READ | idaapi.SEGPERM_WRITE elif kind == 'BSS': segm.perm = idaapi.SEGPERM_READ | idaapi.SEGPERM_WRITE idaapi.update_segm(segm) idaapi.set_segm_addressing(segm, 1 if f.armv7 else 2) # do imports # TODO: can we make imports show up in "Imports" window? undef_count = 0 for s in f.symbols: if not s.shndx and s.name: undef_count += 1 last_ea = max(loadbase + end for start, end, name, kind in f.sections) undef_entry_size = 8 undef_ea = ((last_ea + 0xFFF) & ~0xFFF) + undef_entry_size # plus 8 so we don't end up on the "end" symbol idaapi.add_segm(0, undef_ea, undef_ea+undef_count*undef_entry_size, "UNDEF", "XTRN") segm = idaapi.get_segm_by_name("UNDEF") segm.type = idaapi.SEG_XTRN idaapi.update_segm(segm) for i,s in enumerate(f.symbols): if not s.shndx and s.name: idaapi.create_data(undef_ea, idc.FF_QWORD, 8, idaapi.BADADDR) idaapi.force_name(undef_ea, s.name) s.resolved = undef_ea undef_ea += undef_entry_size elif i != 0: assert s.shndx s.resolved = loadbase + s.value if s.name: if s.type == STT_FUNC: print(hex(s.resolved), s.name) idaapi.add_entry(s.resolved, s.resolved, s.name, 0) else: idaapi.force_name(s.resolved, s.name) else: # NULL symbol s.resolved = 0 funcs = set() for s in f.symbols: if s.name and s.shndx and s.value: if s.type == STT_FUNC: funcs.add(loadbase+s.value) got_name_lookup = {} for offset, r_type, sym, addend in f.relocations: target = offset + loadbase if r_type in (R_ARM_GLOB_DAT, R_ARM_JUMP_SLOT, R_ARM_ABS32): if not sym: print('error: relocation at %X failed' % target) else: idaapi.put_dword(target, sym.resolved) elif r_type == R_ARM_RELATIVE: idaapi.put_dword(target, idaapi.get_dword(target) + loadbase) elif r_type in (R_AARCH64_GLOB_DAT, R_AARCH64_JUMP_SLOT, R_AARCH64_ABS64): idaapi.put_qword(target, sym.resolved + addend) if addend == 0: got_name_lookup[offset] = sym.name elif r_type == R_AARCH64_RELATIVE: idaapi.put_qword(target, loadbase + addend) if addend < f.textsize: funcs.add(loadbase + addend) else: print('TODO r_type %d' % (r_type,)) ida_make_offset(f, target) for func, target in f.plt_entries: if target in got_name_lookup: addr = loadbase + func funcs.add(addr) idaapi.force_name(addr, got_name_lookup[target]) funcs |= find_bl_targets(loadbase, loadbase+f.textsize) for addr in sorted(funcs, reverse=True): idc.AutoMark(addr, idc.AU_CODE) idc.AutoMark(addr, idc.AU_PROC) return 1