opcode search problem

[bfloat16]

First of all, thank you very much for your project. The decompiled asm is very clear. But I want to continue to study the function of opcode, and I have encountered some problems.
When the opcode is smaller, I guess the opcode should be defined as follows:

raw 6 -> goto, raw 11 -> push, raw 12 -> pop（Should it be like this?

But when the opcode is large, I can't find which function handles these opcodes in IDA:

Maybe this function? But it doesn't match the decompiled result.

[robbie01]

In my copy of Cendrillon palikA, it seems like the second function you showed gets called with a2 = 500 (0x1F4), so 0x226 is a2 + 0x32 (an extremely common opcode in my game, at least). In your IDA instance, definitely check the call sites of sub_40110 to see what your game sets as a2.

I am extremely grateful for this info by the way. I've been wanting to add an option to let the user specify mnemonics apart from return in a config file per-invocation, so this gives a lot of insight. I'm a complete noob when it comes to game RE, so I end up smashing my head against the wall every time I've tried to find opcodes. If you don't mind divulging, how did you come upon these function names?

[robbie01]

With regards to the FFFFFFXX opcodes, they might be hardcoded into a switch statement somewhere. If you look in stcm2.rs, there’s some commented out arithmetic opcodes that I extracted from Edel Blume.

[bfloat16]

In my copy of Cendrillon palikA, it seems like the second function you showed gets called with a2 = 500 (0x1F4), so 0x226 is a2 + 0x32 (an extremely common opcode in my game, at least). In your IDA instance, definitely check the call sites of sub_40110 to see what your game sets as a2.

I am extremely grateful for this info by the way. I've been wanting to add an option to let the user specify mnemonics apart from return in a config file per-invocation, so this gives a lot of insight. I'm a complete noob when it comes to game RE, so I end up smashing my head against the wall every time I've tried to find opcodes. If you don't mind divulging, how did you come upon these function names?

There is actually no trick, I pretty much went through the entire string list. These function names are guessed because there is a game that uses very similar functions:
https://github.com/bfloat16/Tools/blob/main/OnlineGame/Unity/THE%20IDOLM%40STER%20CINDERELLA%20GIRLS/script.py#L42

I think I have found the answer. The a2 variable passed in 0x1F4, which matches the opcode in the picture:

{
  __int64 result; // x0

  result = sub_40110(a1, 0x1F4u);
  if ( a1 )
  {
    Switch::STCM2_RegisterOpcode(a1, 0x32Au, off_2E45C0[0], 0);
    Switch::STCM2_RegisterOpcode(a1, 0x334u, off_2E45C8[0], 0);
    return Switch::STCM2_RegisterOpcode(a1, 0x335u, off_2E45D0[0], 0);
  }
  return result;
}

[bfloat16]

The heuristic check for four-byte strings also has some issues, the range check for the variable n doesn’t seem to be correct (?

stcm2-asm/src/disasm.rs

Line 59 in 4751f9b

&& (type_ == 1 || !matches!(n, 0x100000..0x1000000 | 28783))

[robbie01]

Hmm, this is a tough one. I’ll need to rethink the heuristic.

For UTF-8, we might be able to check that it decodes correctly and that all of the characters are in desirable ranges (printable ASCII, kana, Han, etc.) For Shift-JIS, there’s a much larger chance the string will decode correctly, and if it does it’s practically guaranteed to be in a desirable range. My focus has mainly been on UTF-8 games at the moment, but Shift-JIS games should also be first-class citizens too.

(At the very least, it’s a no-brainer if the int value is greater than 0xFFFFFF as all strings are null-terminated.)

In the meantime, would you be able to let me know what game and console your screenshot is from?

[bfloat16]

Hmm, this is a tough one. I’ll need to rethink the heuristic.

For UTF-8, we might be able to check that it decodes correctly and that all of the characters are in desirable ranges (printable ASCII, kana, Han, etc.) For Shift-JIS, there’s a much larger chance the string will decode correctly, and if it does it’s practically guaranteed to be in a desirable range. My focus has mainly been on UTF-8 games at the moment, but Shift-JIS games should also be first-class citizens too.

(At the very least, it’s a no-brainer if the int value is greater than 0xFFFFFF as all strings are null-terminated.)

In the meantime, would you be able to let me know what game and console your screenshot is from?

Game Name: 悠久のティアブレイド for Nintendo Switch
Sample: script.zip

[robbie01]

I've modified the heuristic to be a bit tougher on 3-byte strings, which seems to work for voice lines in Tierblade.

Distinguishing 1- and 2-byte ints from strings is pretty much impossible, as so many of the IDs (for scripts and voice lines) used in Cendrillon palikA happen to decode to two valid ASCII alphabetic characters. It's unfortunate news for Shift-JIS games which likely have some two-byte strings (e.g. a single Han character), but hopefully it won't inhibit research too much.

(Maybe as this gets more advanced, I can implement user-specified opcode and function signatures, which can give better hints.)