Nintendo OpenGL: Difference between revisions

Line 3:

== Description ==

The PICA200 is an opengl ES 1.1 compliant GPU manufactured by DMP. It comes loaded with a number of extensions that make it similar to an openGL ES 2.0 compliant GPU (ability to run programmable vertex/geometry shaders, for instance). Because of this, Nintendo wrapped GPU access into an openGL ES 2.0 implementation with some limitations. As the fragment stage of the pipeline is non-programmable, Nintendo instead gives developers the ability to configure a number of fragment-related values through glGetUniformLocation and ~~glSetUniform~~. See below for the full list.

The PICA200 is an opengl ES 1.1 compliant GPU manufactured by DMP. It comes loaded with a number of extensions that make it similar to an openGL ES 2.0 compliant GPU (ability to run programmable vertex/geometry shaders, for instance). Because of this, Nintendo wrapped GPU access into an openGL ES 2.0 implementation with some limitations. As the fragment stage of the pipeline is non-programmable, Nintendo instead gives developers the ability to configure a number of fragment-related values through glGetUniformLocation and glUniformXX. See below for the full list.

== Shader program structure ==

Line 102:

| dmp_FragmentLightSource[k].distanceAttenuationScale (float)

|}

== Proposed REing methodology ==

1. Choose a "uniform" you want to RE below

2. Take note of its ID and type !

3. Depending on whether its a float or not, go through the gigantic switches in shm_uniformfv or shm_uniformiv (non-float) based on the ID of your uniform

4. Once you find the piece of code specific to your uniform, take note of how the values passed to shm_uniformfv/shm_uniformiv are written to the shader object

5. Go through __shv_validateShaderValidator looking for where those fields written to in shm_uniformfv/shm_uniformiv are used and written to the GPU command buffer either directly or through __cb_writeRegs, __cb_multiWriteReg or __cb_fillRegs.

6. Document findings on 3Dbrew ! (that's the most important step)

== Fragment "uniform" list ==

@@ Line 3: / Line 3: @@
 == Description ==
-The PICA200 is an opengl ES 1.1 compliant GPU manufactured by DMP. It comes loaded with a number of extensions that make it similar to an openGL ES 2.0 compliant GPU (ability to run programmable vertex/geometry shaders, for instance). Because of this, Nintendo wrapped GPU access into an openGL ES 2.0 implementation with some limitations. As the fragment stage of the pipeline is non-programmable, Nintendo instead gives developers the ability to configure a number of fragment-related values through glGetUniformLocation and glSetUniform. See below for the full list.
+The PICA200 is an opengl ES 1.1 compliant GPU manufactured by DMP. It comes loaded with a number of extensions that make it similar to an openGL ES 2.0 compliant GPU (ability to run programmable vertex/geometry shaders, for instance). Because of this, Nintendo wrapped GPU access into an openGL ES 2.0 implementation with some limitations. As the fragment stage of the pipeline is non-programmable, Nintendo instead gives developers the ability to configure a number of fragment-related values through glGetUniformLocation and glUniformXX. See below for the full list.
 == Shader program structure ==
@@ Line 102: / Line 102: @@
 | dmp_FragmentLightSource[k].distanceAttenuationScale (float)
 |}
+== Proposed REing methodology ==
+. Choose a "uniform" you want to RE below
+. Take note of its ID and type !
+. Depending on whether its a float or not, go through the gigantic switches in shm_uniformfv or shm_uniformiv (non-float) based on the ID of your uniform
+. Once you find the piece of code specific to your uniform, take note of how the values passed to shm_uniformfv/shm_uniformiv are written to the shader object
+. Go through __shv_validateShaderValidator looking for where those fields written to in shm_uniformfv/shm_uniformiv are used and written to the GPU command buffer either directly or through __cb_writeRegs, __cb_multiWriteReg or __cb_fillRegs.
+. Document findings on 3Dbrew ! (that's the most important step)
 == Fragment "uniform" list ==