Page 1 of 1

Reading xex files in IDA

Posted: Fri Feb 26, 2010 3:38 pm
by brimcombe
Hi,

So I've opened up an xex file in IDA PRO using xorlosers(<3) plugins and such, but now I was wondering if it were possible to read through the assembly commands and figure out subroutines and such?

I understand it's PowerPC architechture, but I'm not sure where to begin. I found this site, PowerPC beginners guide. Chapter 1, and it seems to be pretty good at explaining ppc and I find I'm understanding it alot more now.

I found going into options->general->and ticking 'auto-comment' is helpful too as it shows what each command is doing.

My main aim is to see how the game loads its game files, so hat I thought previously was that to find where the game accesses it's game files was to just look for a command that loaded the file first into memory, and then go from there. But now I think about, wouldn't all the content already be in memory(whether that be disc/hdd/ram) and it could just be getting accessed a bit at a time by li and lwz commands?? I don't know, could someone provide some insight into how files are accessed?

Re: Reading xex files in IDA

Posted: Sat Feb 27, 2010 4:10 pm
by Grimdoomer
There are a few functions that deal with loading maps in halo 3. I would search in hex workshop for the text string "head". Then copy the hex offset, and in IDA goto Jump -> File Offset, and put it in there. This should bring you to the string, it should already be referenced and have a few xrefs. Just follow them and it will take you to the code that loads the map header.