[PowerPC] Writing PPC in IDA PRO

//Tutorial by Bad Luck Brian

Writing PPC in IDA


So now we learned these things:

-setting a value
-Read/Write in memory
-Code location (Conditional jumps)
-Calling a function

So what about we start writing in our ELF file in IDA Pro ?

This tutorial will also include a video tutorial but not for now :P

Each line of ppc is 4 bytes in length !

example:
Code:
lis r3, 0xFF1    <- it will be written in 4 bytes   (3c 60 0f f1)  <- will explain soon

each instruction as an opcode, an opcode is the hex value of the instruction.

i will make a list of some opcodes, to find any opcodes, just go in ida, click on an instruction and go to hex view.

Code:
li = 0x38
lis = 0x3C
addic = 0x30
stb = 0x98
stw = 0x90
std = 0xF8
lbz = 0x88
lwz = 0x80
ld = 0xE8
cmpwi = 0x2C
b = 0x48 or 0x4B
bl = 0x48 or 0x4B
beq = 0x41, 0x82
bne = 0x40, 0x82
blt = 0x41, 0x80
bgt = 0x41, 0x81
mtctr = 0x7C, 0x69, 0x03, 0xA6
bctrl = 0x4E, 0x80, 0x04, 0x21
Now this is the hard part.

i will write the usage for all of them.


******* li / lis **********
li:
Code:
38 XX VV VV

38 = opcode
XX = Register to load the value into
VV VV = value to load in the register
Now i will explain the XX

you have to add 0x20 for each register

Code:
r0:  38 00 VV VV
r1:  38 20 VV VV
r2:  38 40 VV VV
r3:  38 60 VV VV
r4:  38 80 VV VV
r5:  38 A0 VV VV
r6:  38 C0 VV VV
r7:  38 F0 VV VV

Now for r8+ we need to add +1 to the opcode (0x38 + 0x1 = 0x39)
Code:
r8:  39 00 VV VV
r9:  39 20 VV VV
r10: 39 40 VV VV
r11: 39 60 VV VV
r12: 39 80 VV VV
i will stop at r12 :P

lis is the same thing but with the opcode 3C, and 3D for r8+

lis:

Code:
r0:  3C 00 VV VV
r1:  3C 20 VV VV
r2:  3C 40 VV VV
r3:  3C 60 VV VV
r4:  3C 80 VV VV
r5:  3C A0 VV VV
r6:  3C C0 VV VV
r7:  3C F0 VV VV

Now for r8+ we need to add +1 to the opcode (0x38 + 0x1 = 0x39)
Code:
r8:  3D 00 VV VV
r9:  3D 20 VV VV
r10: 3D 40 VV VV
r11: 3D 60 VV VV
r12: 3D 80 VV VV
---------------------------

addic:

Code:
30 XY VV VV

38 = opcode
X = Register that will contain the result of the addition
Y = Register that were going to add to the value
VV VV = value to add to Y
Now for X, the register system is that same as li/lis
we add 0x20 and at r8 we change the opcode 30 to 31

but for Y, we just put the real number of the register

examples:

Code:
addic r3, r4, 0xFF ||   30 64 00 FF
***

Code:
addic r12, r4, 0xFF ||  31 84 00 FF
***

Code:
addic r3, r10, 0xFF || 30 6A 00 FF     ||  10 = 0x0A  (hexadecimal)
---------------------------
Code:
stb = 0x98    // 0x99 for r8+
stw = 0x90    // 0x91 for r8+
std = 0xF8    // 0xF9 for r8+

i will use stw for the example.

They work like addis for the XY !

Code:
90 XY VV VV

X = register that will be sent in the memory   (VALUE)
Y = register of the address that will receive the VALUE (X)
VV VV = Temporary value to add to the address  (Y)

example:

Code:
lis r3, 0x2100000      || 3C 60 02 10
li r4, 0x15            || 38 80 00 15
stw r4, r3, 0x2101234  || 90 83 12 34
//ON THIS LINE, r3 RESETS BACK TO: 0x2100000 !!!

---------------------------

Code:
lbz = 0x88  // 0x89 for r8+
lwz = 0x80  // 0x81 for r8+
ld = 0xE8   // 0xE9 for r8+
usage (i will use lwz):

Code:
80 XY VV VV

It works like stw !!!

X = register that will contain the value read from the memory
Y = register of the address that will be read
VV VV = Temporary value to add to the address (Y)

Example:

Code:
lis r3, 0x2100000      || 3C 60 02 10
li r4, 0x15            || 38 80 00 15
lwz r4, r3, 0x2101234  || 80 83 12 34
//ON THIS LINE, r3 RESETS BACK TO: 0x2100000  AND r4 = the first bytes that was at: 0x2101234 !!!

-----------------------------------------
Code:
cmpwi = 0x2C

2c 0Y VV VV

0 = keep it as 0
Y = Register to compare, we just put its number in hex
VV VV = value that the register will be compared with

example:
Code:
cmpwi r3, 0x55  || 2c 03 00 55
other example:
Code:
cmwpi r12, 0x55 || 2c 0C 00 55    //0x0C = 12 in hexadecimal
------------------------------------------
Code:
b = 0x48 or 0x4B
bl = 0x48 or 0x4B
beq = 0x41, 0x82
bne = 0x40, 0x82
blt = 0x41, 0x80
bgt = 0x41, 0x81

Alright b and bl are tricky.
//current address = address where we are jumping from

we use 48 when jumping to a location that is located AFTER the current address
we use 4B when jumping to a location that is located BEFORE the current address

Code:
48/4B XX XX XX

XX XX XX = difference between current position and the location we want to jump to


41 82 XX XX

XX XX = difference between current position and the location we want to jump to

also, to use bl we add +1 to the difference !!

example:

Code:
0x11010:  bl 0x11050   || 48 00 00 41
...
0x11050: //function...
// why 84 00 00 41 ? because 0x11050 - 0x11010 = 0x40 and to make it into a bl we need to add +1

0x40 + 1 = 0x41

so 48 00 00 41

and we use 48 because it is AFTER the current location (0x11010)

----------------------------------------------

Now the last one, more complex


mtctr = 7C X9 03 A6

X = register to move to the count register, if r8+, 7C becomes 7D
we keep the rest as it is


Example
Code:
mtctr r4   || 7C 89 03 A6
mtctr r12  || 7D 89 03 A6

bctrl = 4E 80 04 21
we keep it like this, BUT
bctrl (bl) is like bl, but we can also transform it
to bctr , which is like b
Code:
bctr    4E 80 04 20
bctrl   4E 80 04 21
---------------------------------------------

End of lesson, i would advise keeping this in a .txt file for future reference, it is a LOT of information !

also, there is a LOT more instructions, to understand them just get in ida, search for the wanted
instruction and go in hex view and try to find its usage.