カテゴリー
Switch

Switch Atmosphere Debug Breakpoint

1.AtmosphereのGDBを有効化する

EdiZon-SE
https://github.com/tomvita/EdiZon-SE/releases

EdiZon.zipを展開して中身を全て
SDカードのルートにコピーする

SDカードにある
atmosphere/config_templates/system_settings.ini
をコピーしてきて
atmosphere!enable_standalone_gdbstub
という行を追加する
atmosphere/config/
に編集したsystem_settings.iniを配置する

system_settings.ini

Spoiler
[eupld]
; Disable uploading error reports to Nintendo
; upload_enabled = u8!0x0
[usb]
; Enable USB 3.0 superspeed for homebrew
; 0 = USB 3.0 support is system default (usually disabled), 1 = USB 3.0 support is enabled.
; usb30_force_enabled = u8!0x0
[ro]
; Control whether RO should ease its validation of NROs.
; (note: this is normally not necessary, and ips patches can be used.)
; ease_nro_restriction = u8!0x1
[lm]
; Control whether lm should log to the SD card.
; Note that this setting does nothing when log manager is not enabled.
; enable_sd_card_logging = u8!0x1
; Control the output directory for SD card logs.
; Note that this setting does nothing when log manager is not enabled/sd card logging is not enabled.
; sd_card_log_output_directory = str!atmosphere/binlogs
; Atmosphere custom settings
[erpt]
; Control whether erpt reports should always be preserved, instead of automatically cleaning periodically.
; disable_automatic_report_cleanup = u8!0x0
[atmosphere]
; Reboot from fatal automatically after some number of milliseconds.
; If field is not present or 0, fatal will wait indefinitely for user input.
; fatal_auto_reboot_interval = u64!0x0
; Make the power menu’s “reboot” button reboot to payload.
; Set to “normal” for normal reboot, “rcm” for rcm reboot.
; power_menu_reboot_function = str!payload
; Controls whether dmnt cheats should be toggled on or off by
; default. 1 = toggled on by default, 0 = toggled off by default.
; dmnt_cheats_enabled_by_default = u8!0x1
; Controls whether dmnt should always save cheat toggle state
; for restoration on new game launch. 1 = always save toggles,
; 0 = only save toggles if toggle file exists.
; dmnt_always_save_cheat_toggles = u8!0x0
; Enable writing to BIS partitions for HBL.
; This is probably undesirable for normal usage.
; enable_hbl_bis_write = u8!0x0
; Enable reading the CAL0 partition for HBL.
; This is probably undesirable for normal usage.
; enable_hbl_cal_read = u8!0x0
; Controls whether fs.mitm should redirect save files
; to directories on the sd card.
; 0 = Do not redirect, 1 = Redirect.
; NOTE: EXPERIMENTAL
; If you do not know what you are doing, do not touch this yet.
; fsmitm_redirect_saves_to_sd = u8!0x0
; Controls whether am sees system settings “DebugModeFlag” as
; enabled or disabled.
; 0 = Disabled (not debug mode), 1 = Enabled (debug mode)
; enable_am_debug_mode = u8!0x0
; Controls whether dns.mitm is enabled
; 0 = Disabled, 1 = Enabled
; enable_dns_mitm = u8!0x1
; Controls whether dns.mitm uses the default redirections in addition to
; whatever is specified in the user’s hosts file.
; 0 = Disabled (use hosts file contents), 1 = Enabled (use defaults and hosts file contents)
; add_defaults_to_dns_hosts = u8!0x1
; Controls whether dns.mitm logs to the sd card for debugging
; 0 = Disabled, 1 = Enabled
; enable_dns_mitm_debug_log = u8!0x0
; Controls whether htc is enabled
; 0 = Disabled, 1 = Enabled
; enable_htc = u8!0x0
; Controls whether atmosphere’s log manager is enabled
; Note that this setting is ignored (and treated as 1) when htc is enabled.
; 0 = Disabled, 1 = Enabled
; enable_log_manager = u8!0x0
enable_standalone_gdbstub = u8!0x1
[hbloader]
; Controls the size of the homebrew heap when running as applet.
; If set to zero, all available applet memory is used as heap.
; The default is zero.
; applet_heap_size = u64!0x0
; Controls the amount of memory to reserve when running as applet
; for usage by other applets. This setting has no effect if
; applet_heap_size is non-zero. The default is 0x8600000.
; applet_heap_reservation_size = u64!0x8600000

2.Switch で Memory Search

ゲームを起動して特定したい数値を確認し
アルバムを開いてEdiZon SE を開く
Yを押してTYPE MODE REGION VALUE
を選択してSearch
ゲームで値を変更し再度EdiZon SE を開き
Yを押してアドレスを絞り込む
アドレスを特定する
特定できればZl+Bを押してデタッチする
(デタッチしなければIDAからプロセスが見えなくなる)

3.IDA から Switch にアタッチ

IDA を起動して go を押す
Debugger
Attach
Remote GDB debugger
を選択してOK

Hostname をSwitch ipアドレスに
Port 22225
にする
Debug options をクリック
Set Specific options をクリック
Configuration をARM64 (AArch64) に変更してOK
Applicationを選択してOK
アタッチするとプロセスが止まる
viewでg を押すとアドレスを変更できるので
先ほど特定したアドレスに移動
右クリックして、Addwritetrace を押すと
Memorywritebreakpointがセットされる
F9を押してゲームを再開する
ゲームで値を変動させるとbreakする
IDA でSuspend をクリック

4.main 逆アセンブル

IDA/loaders フォルダに Switch64.dll を配置
https://github.com/pgarba/SwitchIDAProLoader

ida でmainを開く

https://gbatemp.net/threads/a-short-excursion-into-asm-with-edizon-se-and-gdb.603400/
GDB Compatibility and other tweaks

コメントを残す

メールアドレスが公開されることはありません。

inserted by FC2 system