CRO0

Offset	Size	Description
0x0	0x80	SHA-256 hash-table, verified by CRR
0x80	0x04	Magic "CRO0"
0x84	0x04	Name offset
0x88	0x08	Previous / Next loaded CRO pointer, set by RO during loading
0x90	0x04	File size
0x94	0x18	Unknown
0xAC	0x04	"Segment offset", symbols are loaded relative to this. Probably filled by dynamic linker, set to 0xFFFFFFFF in file.
0xB0	0x04	Code offset
0xB4	0x04	Code size
0xB8	0x04	unk1 offset
0xBC	0x04	unk1 size
0xC0	0x04	Module Name offset
0xC4	0x04	Module Name size
0xC8	0x04	Segment Table offset
0xCC	0x04	Segment Table num (size = num*12)
0xD0	0x04	Export Table offset
0xD4	0x04	Export Table num (size = num * 8)
0xD8	0x04	unk3 offset
0xDC	0x04	unk3 num
0xE0	0x04	Export Strings offset
0xE4	0x04	Export Strings size
0xE8	0x04	Export Tree offset (fast lookups based on strlen)
0xEC	0x04	Export Tree num (size = num * 8)
0xF0	0x04	unk4 offset
0xF4	0x04	unk4 num
0xF8	0x04	Import Patches offset
0xFC	0x04	Import Patches num (size = num * 12)
0x100	0x04	Import Table 1 offset
0x104	0x04	Import Table 1 num (size = num * 8)
0x108	0x04	Import Table 2 offset
0x10C	0x04	Import Table 2 num (size = num * 8)
0x110	0x04	Import Table 3 offset
0x114	0x04	Import Table 3 num (size = num * 8)
0x118	0x04	Import Strings offset
0x11C	0x04	Import Strings size
0x120	0x04	unk8 offset
0x124	0x04	unk8 num
0x128	0x04	Relocation Patches offset
0x12C	0x04	Relocation Patches num (size = num * 12)
0x130	0x04	unk9 offset
0x134	0x04	unk9 num

Segment offset (4 bytes)

Bits	Description
0-3	Segment index for table
4-31	Offset into segment

Segment Table entry (12 bytes)

Offset	Size	Description
0x0	0x4	Segment offset
0x4	0x4	Segment size
0x8	0x4	Segment id (0, 1, 2..)

Export Table entry (8 bytes)

Offset	Size	Description
0x0	0x4	Name offset
0x4	0x4	"Segment offset" for export

Import Table entry (8 bytes)

Offset	Size	Description
0x0	0x4	Name offset
0x4	0x4	Offset of the head of a linear list that contains the patches for this import

Patch entry (12 bytes)

Offset	Size	Description
0x0	0x4	"Segment offset" for output.
0x4	0x1	Patch type (0=nothing/ignore, 2=38=write u32 absolute (base+X), 3=write u32 relative (base+X-in_ptr), 10=THUMB branch, 28=ARM32 branch, 29=modify ARM32 branch offset, 42=write u32 relative (((signed int)base*2)/2+X-in_ptr), otherwise err)
0x5	0x1	Non-zero if last entry.
0x6	0x1	1 is written to last entry if all symbols loaded successfully.
0x7	0x1	Unknown
0x8	0x4	X (00's in file, probably set by dynamic linker)

ARM32 branch instruction is constructed as follows:

 If X > 0x2000000 or X < 0xFE000000, then skip.
 If (X&1) == 1 then write "b +4" (nop).
 Else write as normal.

---

CRO with extension .cro is used for "DLLs". CRS with extension .crs can be used for storing "DLL" symbols as well. The end of the file is aligned to a 0x1000-byte boundary with 0xCC bytes. CRO0 files are usually stored under "romfs:/cro/".

The first hash-table entry hashes the 0x100-byte header following the hash-table. The following hash-table entries hash the sections specified in the header.

When the RO module loads the entire CRO into process memory(mapped in the 0x00100000-0x04000000 region), it modifies the mapped CRO data. The magic field is also changed to "FIXD".

Upon loading, the RO module will look for symbol "__aeabi_atexit" or "nnroAeabiAtexit_".

For dumping symbols and loading a CRO into IDA, see [1].