The Adventures of NSA grade Reverse-Engineering

The last few days had been very exciting for me since i made a lot of progress on reverse-engineering the Growlanser 6 ELF (executable) file.

One problem that we had in the past was the fact that in the GL6 ELF file "SLPM_667.16" there was a lot of text that we couldn't find the corresponding pointers for.
So, whenever i wanted to translate a text string, i had to be careful not to "clip" into the next text:

This made some text look squished in, like in the examples above.

So, i spent hours on trying to figure out how this stupid-ass file works.
Using tools like the PCSX2 debugger to see what the hell is going on while the game is running (but having no idea what the hell i'm actually looking at).
Using tools like "ps2dis" to check out the ELF file, but, again, having no idea what i'm looking at  since i have no experience in programming or assembly.
Searching the internet once again for guides/tutorials on how to figure out how assembly and the PS2s Emotion Engine works....

After many, many hours of reading, trial'n'error, and some more reading i found this blog post:

https://aloshi.com/archives/46

And this very passage:

I used ps2dis before, but all the things on screen made no sense to me.
But i knew that when i searched for "Victory Cond." i could find my text in ps2dis.
With "SPACE" i marked it and then used F3 to let me jump to the place that points to this position, just like the guy in the tutorial.
I found a place in the ELF file that actually points to my text:

At first i couldn't really figure out what the different numbers and text meant.
But, according to ps2dis the hex row "24 84 CC 00" was pointing to my text.
Since i had a 2nd reference point (the Defeat Cond. below) i was doing some more trial'n'error to see if this is really the famous pointers that i was looking for.
I checked if i could find my hex array through a hex editor, and after having a positive result i was certain that i might have found my holy grail:

So, as a little test i switched the pointers for both of them around to check if it would switch the references around in the disassembler too - And oh boy it did!
Ingame the text was changed and no errors of any kind occured.
I can't believe that all of that was right in front of my eyes... ^^'

ps2dis was quite an old tool and i remembered that a year ago i tried to use the new NSA open-source reverse-engineering tool called "Ghidra":

https://github.com/NationalSecurityAgency/ghidra

Sadly at that point the Ghidra tool had no MIPS 5900 (PS2s Emotion Engine) processor, which can fully reverse-engineer the ELF file, and i couldn't find/figure out anything worthwile.
But, looking at it again earlier this month i saw that somebody actually started a project on github to add an Emotion Engine processor for Ghidra:

https://github.com/beardypig/ghidra-emotionengine

(sadly the github releases page is not up-to-date, i compiled the latest files into a Ghidra Processor and put it on the translation repository:

https://bitbucket.org/Risae/growlanser-6-english-translation/downloads/ghidra_9.1.2_PUBLIC_20200225_ghidra-emotionengine-master.zip)

With that processor i was able to analyze a lot of functions of the ELF, which made me see even more of what is going on inside of it:

Sadly searching for SHIFT-JIS encoded strings didn't really seem to work, or at least i couldn't find out how to make it work for now...
But i was able to find pretty much every pointer for the strings, and how to modify them to give the text enough space to write.

Here are some examples, before and after:

(the textbox clipping will be fixed at some other time)


Feels good that i'm making progress on de-mystifying the ELF file.
The Ghidra tool is really god damn powerful, some of the options that you can use in there gives a really good overview of what is happening in the ELF file.
With a lot of luck and time i hope i can find a way to rewrite/change the code that draws the text and make it variable width like in GL5.