vgkintsugi/ghidra-segasaturn-processor

A Ghidra processor module for the Sega Saturn (SuperH SH-2)

This repository is archived now that it has been merged upstream into Ghidra. The SuperH SH-1/SH-2 processor module (and many bug fixes!) are included with the 9.1 release of Ghidra. File any bug reports with the Ghidra repository and I (VGKintsugi) will take a look.

Ghidra Sega Saturn Processor Module

A (WIP) Ghidra processor module for the Sega Saturn. The Sega Saturn uses dual SuperH SH-2 processors for games and a dedicated SuperH SH-1 to control the CD-ROM drive.

Currently:

• able to disassemble SH-1 and SH-2 after manually specifying the processor type. I used the instruction encodings available from Renesas SH Instruction Set Summary and related GitHub project shared-ptr/sh_insns.
• contains SLEIGH definitions for all instructions. Currently debugging through issues related to sign extensions, flags, and branches.
• able to decompile automatically. Output looks reasonable but likely to have issues due to errors in the SLEIGH definitions.

Todo:

• fix remaining errors in SLEIGH definitions
• create loader plugin (in a separate project)

Screenshots

Processors

Loader

Disassembly View (Decompiler working, still has some bugs)

Issues

I fixed a lot of the errors in the SLEIGH definitions but I anticipate there will be more bugs.

Installation

• Rename the root folder to SuperH and copy it to Ghidra/Processors/ and restart Ghidra

Credits

• shared-ptr/sh_insns - SH-1/SH-2 instruction definitions
• Yabause - Sega Saturn emulator I used to verify my disassembly and execution
• Sega Saturn Multiplayer Task Force - repo of homebrew Sega Saturn games with source code
• xyzz/ghidra-mep - example Ghidra processor module
• Thog/ghidra_falcon - example Ghidra processor module

ghidra-segasaturn-processor's Issues

SH-2A Support + FPU + Fixes

Hi @VGKintsugi

Nice work with the repo, we use it at Toka.

We would like to contribute the following enhancements: we've added a new variant: SH-2A, as well as FPU support and various fixes that I see you addressed some of them already. We get a clean decompile in Ghidra.

A little suggestion, since SH-2A is not SegaSaturn, what about renaming the project to ghidra-processor-superh or something similar?

Let me know what are your thought and I will initiate a new pull request for this issue.

Thanks,
Guy

Add Patterns

The patterns in the patternconstants.xml are used to enhance and speed up detection of various things, one of which is the function start.
Crude ones I've been using are

<patternlist>
  <pattern>
     <data>0x2F86</data> <!-- mov.l   r8, @-r15 -->
     <codeboundary/>
     <possiblefuncstart/>
  </pattern>
  <pattern>
     <data>0x2FE6</data> <!-- mov.l   r14, @-r15 -->
     <codeboundary/>
     <possiblefuncstart/>
  </pattern>
</patternlist>

but i have near no knowledge of SuperH so i dunno what else could be added.

Args that are in the stack are incorrect or missing

In the Saturn sdk \SAMPLE\S_9_1\SCL_FUNC.C the function Map2VRAM has the args ( Uint16 *Map_Data , Uint32 Map_Adr , Uint16 suuj , Uint16 suui , Uint16 palnum ,Uint32 mapoff) but Ghidra decompiles it with the first 4 args and rest go missing, instead the code has weird unaff_r# in_r# which are usually accompanied by a + 0xXX offset in some functions.

void Map2VRAM(ushort *puParm1,short *psParm2,uint uParm3,ushort uParm4)
{
    ushort uVar1;
    int in_r1;
    uint uVar2;
    uint uVar3;
    ushort uVar4;
    int in_r9;
    undefined4 uVar5;
    bool bVar6;
    
    uParm3 &= 0xffff;
    uVar2 = *(uint *)(in_r1 + 0xc);
    uVar4 = 0;
    uVar5 = *(undefined4 *)(in_r9 + 0x10);
    if (uParm4 == 0) {
        bVar6 = true;
    }
    else {
        bVar6 = false;
    }
    if (!bVar6) {
        do {
            uVar3 = 0;
            if (uParm3 == 0) {
                bVar6 = true;
            }
            else {
                bVar6 = false;
            }
            while (!bVar6) {
                uVar1 = *puParm1;
                if (true) {
                    puParm1 = (ushort *)((int)puParm1 + 1);
                }
                *psParm2 = (uVar1 | (ushort)((uVar2 & 0xf) << 0xc)) + (short)uVar5;
                uVar3 = uVar3 + 1 & 0xffff;
                if (uVar3 < uParm3) {
                    bVar6 = false;
                }
                else {
                    bVar6 = true;
                }
                psParm2 = psParm2 + 1;
            }
            uVar4 += 1;
            if (uVar4 < uParm4) {
                bVar6 = false;
            }
            else {
                bVar6 = true;
            }
            psParm2 = psParm2 + (0x40 - uParm3);
        } while (!bVar6);
    }
    return;
}

I was looking at C&C for the Saturn where there are a lot of class functions that have a lot of args but to hopefully simplify debugging this i tried to find functions that will have similar issues in the SDK(as it is unknown if anything is different compared to the info i have on the C&C PC counterpart so its probably not the best thing to examine in this case).

SCL_InitRotateTable
SCL_SetDisplayMode
SCL_SetAutoColChg
ex_keyword2
BPL_GetStmInfo
GFCD_GetLenData
GFS_GetFileSize
PCM_GetWriteBuf
Map2VRAM
gxSetMaterial
SND_CtrlDirMidi
GFS_GetFileSize
STM_GetInfo
FNT_Print256
BPL_GetStmInfo
MTH_Curve2
MPG_GetReport
MPG_SpGetTimeCode
SPR_3AllCoordTransClipPers
MPSYS_DoPlay
MPG_MvGetTimeCode
PCM_MeGetRingWrite
pcm_GetPcmWrite

should be ones that would have arg issues like these.