CRO0 - Revision history

Kynex7510: Segment type

2026-02-14T08:22:43Z

Segment type

← Older revision		Revision as of 11:22, 14 February 2026
Line 248:		Line 248:
	\| 0x8		\| 0x8
	\| 0x4		\| 0x4
	\| Segment ~~id (~~0 = .text, 1 = .rodata, 2 = .data, 3 = .bss)		\| Segment type: 0 = executable (.text), 1 = read only (.rodata), 2 = read/write (.data), 3 = zero-initialized (.bss)
	\|}		\|}

			RO expects only one of executable, read/write and zero-initialized segments, but there's no limit on read only segments.

	== Named Export Table entry ==		== Named Export Table entry ==

AlgebraManiacABC: /* Import Module Table entry */ The order of "Offset" vs "Count" was swapped... at least for this `.crs` file I'm reading.

2026-01-20T10:10:23Z

Import Module Table entry: The order of "Offset" vs "Count" was swapped... at least for this `.crs` file I'm reading.

← Older revision		Revision as of 13:10, 20 January 2026
Line 365:		Line 365:
	\| 0x4		\| 0x4
	\| 0x4		\| 0x4
	\| Indexed ~~import num~~		\| Offset of the head of a sub list in Indexed Import Table
	\|-		\|-
	\| 0x8		\| 0x8
	\| 0x4		\| 0x4
	\| ~~Offset of the head of a sub list in~~ Indexed ~~Import Table~~		\| Indexed import num
	\|-		\|-
	\| 0xC		\| 0xC
	\| 0x4		\| 0x4
	\| Anonymous ~~import num~~		\| Offset of the head of a sub list in Anonymous Import Table
	\|-		\|-
	\| 0x10		\| 0x10
	\| 0x4		\| 0x4
	\| ~~Offset of the head of a sub list in~~ Anonymous ~~Import Table~~		\| Anonymous import num
	\|}		\|}

Kynex7510: About hashes

2025-12-26T13:19:31Z

About hashes

← Older revision		Revision as of 16:19, 26 December 2025
Line 3:		Line 3:
	CRO with extension .cro is used for "DLLs". CRS with extension .crs is in the same format of CRO but storing the symbol information of the static module (the main application). The end of the file is aligned to a 0x1000-byte boundary with 0xCC bytes.		CRO with extension .cro is used for "DLLs". CRS with extension .crs is in the same format of CRO but storing the symbol information of the static module (the main application). The end of the file is aligned to a 0x1000-byte boundary with 0xCC bytes.

	The ~~first hash-table entry~~ hashes the ~~0x100-byte header following~~ the hash~~-table. The following hash-~~table ~~entries hash the sections specified in the header~~.		The CRO hashes before the magic are hashed themselves and verified against the [[CRR0\|CRR]] hash table.

	When the RO module loads the entire CRO into process memory(mapped in the 0x00100000-0x04000000 region), it ~~modifies~~ the mapped CRO data. The magic field is also changed to "FIXD" if fix level is not 0.		When the RO module loads the entire CRO into process memory (mapped in the 0x00100000-0x04000000 region), it relocates the mapped CRO data (eg. such that offsets can be dereferenced). The magic field is also changed to "FIXD" if fix level is not 0.

	Upon loading, the RO module will look for export symbol "nnroAeabiAtexit_" to patch it to its import symbol "__aeabi_atexit".		Upon loading, the RO module will look for export symbol "nnroAeabiAtexit_" to patch it to its import symbol "__aeabi_atexit".
Line 18:		Line 18:
	! Description		! Description
	\|-		\|-
	\| ~~0x0~~		\| 0x00
	\| 0x80		\| 0x20
	\| SHA-256 hash-~~table~~, ~~verified by [[CRR0~~\|~~CRR]]~~		\| SHA-256 hash over the raw data from offset 0x80 to *(code offset), exclusive
			\|-
			\| 0x20
			\| 0x20
			\| SHA-256 hash over the raw data from (code offset) to (module name offset), exclusive
			\|-
			\| 0x40
			\| 0x20
			\| SHA-256 hash over the raw data from (module name offset) to (data offset), exclusive
			\|-
			\| 0x60
			\| 0x20
			\| SHA-256 hash over the raw data from (data offset) to (data offset + data size), exclusive (RO does NOT check this hash)
	\|-		\|-
	\| 0x80		\| 0x80

Kynex7510: Trie entries + unknown fields

2025-12-26T11:08:18Z

Trie entries + unknown fields

Show changes

Kynex7510 at 21:53, 15 August 2025

2025-08-15T19:53:17Z

← Older revision		Revision as of 23:53, 15 August 2025
Line 446:		Line 446:
	\|-		\|-
	\| 0		\| 0
	\| Write address of "nnroEitNode_" to memory pointed by arg ((u32)p = &nnroEitNode_)		\| Write address of "nnroEitNode_" to memory pointed by arg ((u32)arg = &nnroEitNode_)
	\|-		\|-
	\| 1		\| 1
	\| Set global in CRO to arg, where arg is the CRO end (g_CRO_end = p)		\| Set global in CRO to arg, where arg is the CRO end (g_CRO_end = (u32)arg)
	\|-		\|-
	\| 2		\| 2
	\| Write CRO end to memory pointed by arg ((u32)p = g_CRO_end)		\| Write CRO end to memory pointed by arg ((u32)arg = g_CRO_end)
	\|-		\|-
	\| 3		\| 3
	\| Write begin, end of function list (C initializers?) to memory pointed by arg ((u32)p = listBegin, ((u32*)p)[1] = listEnd)		\| Write begin, end of function list (C initializers?) to memory pointed by arg ((u32)arg = (u32)listBegin, ((u32*)arg)[1] = (u32)listEnd)
	\|-		\|-
	\| 4		\| 4
	\| Write begin, end of function list (C++ initializers?) to memory pointed by arg ((u32)p = listBegin, ((u32*)p)[1] = listEnd)		\| Write begin, end of function list (C++ initializers?) to memory pointed by arg ((u32)arg = (u32)listBegin, ((u32*)arg)[1] = (u32)listEnd)
	\|}		\|}

Kynex7510: nnroControlObject

2025-08-15T19:51:24Z

nnroControlObject

@@ Line 10: / Line 10: @@
 For dumping symbols and loading a CRO into IDA, see [https://github.com/plutooo/ctr/] and [https://github.com/wwylele/IDA_plugin_CRO].
 {| class="wikitable" border="1"
@@ Line 432: / Line 434: @@
       return 0xD9012C22;
+  }

Kynex7510: Relocation code

2025-07-23T20:19:20Z

Relocation code

@@ Line 347: / Line 347: @@
 | 0x4
 | 0x1
-| Patch type (0=nothing/ignore, 2=38=write u32 absolute (base+addend), 3=write u32 relative (base+addend-in_ptr), 10=THUMB branch, 28=ARM32 branch, 29=modify ARM32 branch offset, 42=write u32 relative (((signed int)base*2)/2+addend-in_ptr), otherwise err) (This is apparently a subset of relocation type for ARM ELF)
+| Patch type (R_ARM_NONE = 0, R_ARM_ABS32 = 2, R_ARM_REL32 = 3, R_ARM_THM_PC22 = 10, R_ARM_CALL = 28, R_ARM_JUMP24 = 29, R_ARM_TARGET1 = 38, R_ARM_PREL31 = 42)
 |-
 | 0x5
@@ Line 366: / Line 366: @@
 |}
-ARM32 branch instruction is constructed as follows:
+Relocation code from RO:
-----
+ static Result writePatch(u32* out, u32 patchType, u32 addend, u32 base, u32 inputPtr) {

DeltaF1: Add headers to all the structs

2024-12-31T00:40:57Z

Add headers to all the structs

← Older revision		Revision as of 03:40, 31 December 2024
Line 218:		Line 218:
	\|}		\|}

	Segment Table entry (12 bytes)		==Segment Table entry (12 bytes)==
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	! Offset		! Offset
Line 237:		Line 237:
	\|}		\|}

	Named Export Table entry (8 bytes)		==Named Export Table entry (8 bytes)==
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	! Offset		! Offset
Line 252:		Line 252:
	\|}		\|}

	Indexed Export Table entry (4 bytes)		==Indexed Export Table entry (4 bytes)==
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	! Offset		! Offset
Line 263:		Line 263:
	\|}		\|}

	Named Import Table entry (8 bytes)		==Named Import Table entry (8 bytes)==
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	! Offset		! Offset
Line 278:		Line 278:
	\|}		\|}

	Indexed Import Table entry (8 bytes)		==Indexed Import Table entry (8 bytes)==
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	! Offset		! Offset
Line 293:		Line 293:
	\|}		\|}

	Anonymous Import Table entry (8 bytes)		==Anonymous Import Table entry (8 bytes)==
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	! Offset		! Offset
Line 308:		Line 308:
	\|}		\|}

	Import Module Table entry (20 bytes)		==Import Module Table entry (20 bytes)==
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	! Offset		! Offset
Line 335:		Line 335:
	\|}		\|}

	Patch entry (12 bytes)		==Patch entry (12 bytes)==
	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
	! Offset		! Offset

DeltaF1: Fix hyperlinks to link to section

2024-12-31T00:36:07Z

Fix hyperlinks to link to section

← Older revision		Revision as of 03:36, 31 December 2024
Line 54:		Line 54:
	\| 0xA0		\| 0xA0
	\| 0x04		\| 0x04
	\| [[Segment offset (4 bytes)\|Segment offset]] that is always the same as export symbol "nnroControlObject_". 0xFFFFFFFF in CRS		\| [[#Segment offset (4 bytes)\|Segment offset]] that is always the same as export symbol "nnroControlObject_". 0xFFFFFFFF in CRS
	\|-		\|-
	\| 0xA4		\| 0xA4
	\| 0x04		\| 0x04
	\| [[Segment offset (4 bytes)\|Segment offset]] for "OnLoad" function, which will be called when the module is initialized. Set to 0xFFFFFFFF if not exists.		\| [[#Segment offset (4 bytes)\|Segment offset]] for "OnLoad" function, which will be called when the module is initialized. Set to 0xFFFFFFFF if not exists.
	\|-		\|-
	\| 0xA8		\| 0xA8
	\| 0x04		\| 0x04
	\| [[Segment offset (4 bytes)\|Segment offset]] for "OnExit" function, which will be called when the module is finalized. Set to 0xFFFFFFFF if not exists.		\| [[#Segment offset (4 bytes)\|Segment offset]] for "OnExit" function, which will be called when the module is finalized. Set to 0xFFFFFFFF if not exists.
	\|-		\|-
	\| 0xAC		\| 0xAC
	\| 0x04		\| 0x04
	\| [[Segment offset (4 bytes)\|Segment offset]] for "OnUnresolved" function, which will be called when an unresolved function is called. Set to 0xFFFFFFFF if not exists.		\| [[#Segment offset (4 bytes)\|Segment offset]] for "OnUnresolved" function, which will be called when an unresolved function is called. Set to 0xFFFFFFFF if not exists.
	\|-		\|-
	\| 0xB0		\| 0xB0
Line 249:		Line 249:
	\| 0x4		\| 0x4
	\| 0x4		\| 0x4
	\| [[Segment offset (4 bytes)\|Segment offset]] for export		\| [[#Segment offset (4 bytes)\|Segment offset]] for export
	\|}		\|}

Line 260:		Line 260:
	\| 0x0		\| 0x0
	\| 0x4		\| 0x4
	\| [[Segment offset (4 bytes)\|Segment offset]] for export		\| [[#Segment offset (4 bytes)\|Segment offset]] for export
	\|}		\|}

Line 301:		Line 301:
	\| 0x0		\| 0x0
	\| 0x4		\| 0x4
	\| [[Segment offset (4 bytes)\|Segment offset]] of the export symbol		\| [[#Segment offset (4 bytes)\|Segment offset]] of the export symbol
	\|-		\|-
	\| 0x4		\| 0x4
Line 343:		Line 343:
	\| 0x0		\| 0x0
	\| 0x4		\| 0x4
	\| [[Segment offset (4 bytes)\|Segment offset]] for output.		\| [[#Segment offset (4 bytes)\|Segment offset]] for output.
	\|-		\|-
	\| 0x4		\| 0x4

DeltaF1: Link to the definition for segment offsets

2024-12-31T00:33:32Z

Link to the definition for segment offsets

← Older revision		Revision as of 03:33, 31 December 2024
Line 54:		Line 54:
	\| 0xA0		\| 0xA0
	\| 0x04		\| 0x04
	\| "Segment offset" that is always the same as export symbol "nnroControlObject_". 0xFFFFFFFF in CRS		\| [[Segment offset (4 bytes)\|Segment offset]] that is always the same as export symbol "nnroControlObject_". 0xFFFFFFFF in CRS
	\|-		\|-
	\| 0xA4		\| 0xA4
	\| 0x04		\| 0x04
	\| "Segment offset" for "OnLoad" function, which will be called when the module is initialized. Set to 0xFFFFFFFF if not exists.		\| [[Segment offset (4 bytes)\|Segment offset]] for "OnLoad" function, which will be called when the module is initialized. Set to 0xFFFFFFFF if not exists.
	\|-		\|-
	\| 0xA8		\| 0xA8
	\| 0x04		\| 0x04
	\| "Segment offset" for "OnExit" function, which will be called when the module is finalized. Set to 0xFFFFFFFF if not exists.		\| [[Segment offset (4 bytes)\|Segment offset]] for "OnExit" function, which will be called when the module is finalized. Set to 0xFFFFFFFF if not exists.
	\|-		\|-
	\| 0xAC		\| 0xAC
	\| 0x04		\| 0x04
	\| "Segment offset" for "OnUnresolved" function, which will be called when an unresolved function is called. Set to 0xFFFFFFFF if not exists.		\| [[Segment offset (4 bytes)\|Segment offset]] for "OnUnresolved" function, which will be called when an unresolved function is called. Set to 0xFFFFFFFF if not exists.
	\|-		\|-
	\| 0xB0		\| 0xB0
Line 205:		Line 205:
	\|}		\|}

	Segment offset (4 bytes)		==Segment offset (4 bytes)==

	{\| class="wikitable" border="1"		{\| class="wikitable" border="1"
Line 249:		Line 249:
	\| 0x4		\| 0x4
	\| 0x4		\| 0x4
	\| "Segment offset" for export		\| [[Segment offset (4 bytes)\|Segment offset]] for export
	\|}		\|}

Line 260:		Line 260:
	\| 0x0		\| 0x0
	\| 0x4		\| 0x4
	\| "Segment offset" for export		\| [[Segment offset (4 bytes)\|Segment offset]] for export
	\|}		\|}

Line 301:		Line 301:
	\| 0x0		\| 0x0
	\| 0x4		\| 0x4
	\| "Segment offset" of the export symbol		\| [[Segment offset (4 bytes)\|Segment offset]] of the export symbol
	\|-		\|-
	\| 0x4		\| 0x4
Line 343:		Line 343:
	\| 0x0		\| 0x0
	\| 0x4		\| 0x4
	\| "Segment offset" for output.		\| [[Segment offset (4 bytes)\|Segment offset]] for output.
	\|-		\|-
	\| 0x4		\| 0x4