FFXIV IDA Bruteforce Guide

FFXIVIdaGuide.md

IDA Bruteforce Guide (written by someone who is totally clueless and just wanted to get stuff working)

How to set up the environment.

1. Get IDA Pro from somewhere, in this "guide" I use IDA Pro 7.5
2. Install Python 3.5 or newer, in this "guide" I use Python 3.8.5
3. Download pySigMaker.py or SigMaker, in this "guide" I use pySigMaker.
4. Clone or download latest FFXIVClientStructs
5. Copy pySigMaker.py in IDA Install Directory\Plugins

Dissassembling FFXIV

You will need to disassemble FFXIV every time patch if ffxiv_dx11.exe is updated.

1. Open IDA Install Directory\ida64.exe

2. Click New
3. Choose the file FFXIV Install Directory\game\ffxiv_dx11.exe

4. Choose the default options and hit OK

5. When it asks for the input file with debug information hit yes in the hopes SE published their pdb by accident (thanks KazWolfe).

6. Wait for IDA to be done disassembling, check the bottom left of IDA to see if it's still busy.
7. Meanwhile, run python -m pip install pyyaml in any command prompt that has access to the installed Python

8. When you see AU: idle in the bottom left corner of IDA you'll know when IDA is done disassembling.

9. Hit File -> Script File -> Open FFXIVClientStructs\ida\ffxiv_idarename.py
10. Let the script run, IDA might be unresponsive while it's doing this, you might get some errors which is totally fine.
11. Now IDA should be set up to do some basic stuff.

Making a signature for a function and finding the arguments

1. Find the function you want to make a signature for, either through browsing through some of the renamed functions or through an offset somebody has given you and open it.
2. In this "guide" I'll make a signature for Client__UI__Agent__AgentHUD_OpenContextMenuFromTarget
3. Go to Edit -> Plugins -> pySigMaker (or hit CTRL-ALT-S).

4. Click "Sig for current function", this will copy the signature for use into your clipboard.
5. In this example the signature we got is: 48 85 D2 74 7F 48 89 5C 24, if your signature has question marks in them like 00 ? 34 FC ? add extra question marks like: 00 ?? 34 FC ??.

6. We still need to figure out the arguments we want need to use, either read the assembly if you can understand it or hit tab (or hit Jump -> Jump to Pseudocode).
7. In this example we see the call needs 2 arguments which are both IntPtr. Knowing what arguments to use will need some experience/help.

For now this concludes this shitty bruteforce guide. Any changes and recommendations to this file are welcome.

Zeffuro