How I Fixed a 10 Year Old Guitar Hero Bug Without the Source Code

[@leglaff5096]

fixes 10 year old bug for a huge community community switches to a new game rip

[@kristiann4346]

leglaff "huge" lol you think the gh3 community is huge? The game has been dead for years.

[@eliel1815shadow]

daah, kristian is right dudes, just like doom comunitty, they are long dead by now irl, the real huge communities are on PUBG right now fucking loosers (it is sarcasm)

[@CAPTAIN_CLOCK]

I hate how they all changed to clone hero... I mean its easier to add customs but its not even official

[@Nettacki]

GH3 with a bunch of mods attached isn't official either.

[@Jdb_]

Gameplays CCXXI doesn’t mean it isn’t good it’s still a very good clone with a easy way to add songs and it is comparable to gh3 it makes sense to change

[@JasonParadise]

This is an understatement: You're fucking incredible.

[@SkeletorAssasin]

Language plezz :P

[@ivanvelasco3757]

"No cursing on my Christian app please 😇"

[@jonte3132]

SORRY SIR YOU ARE IN A CHRISTIAN COMMENT SECTION ALL SWEARING PROHIBITED

[@necro_nova]

Hi Jason :)

[@TearTheRoof0ff]

Well, fuck.

[@acai28]

The ELI5 bits are fucking incredible. Thank you for all the good shit Exile

[@Justdat799]

SB Gaming TF?

[@nightnightfire644]

SB Gaming stfu

[@acai28]

the term 'explain like i'm 5' doesn't apply to just reddit, dumbass

[@nightnightfire644]

Acai ya he's a fuck head you're the only one I swear who doesn't do fake gh3 vids I love them

[@donnaken15]

+J-rod H he doesn't play Guitar Hero anymore

[@GavinPugh]

Well done! As an ex-NS developer, that was a cool trip down memory lane. :) Funny to see how many "Skater" references shipped in GH3!

[@martti2598]

As LocalH loves to say, GH3 is a note hitting engine glued to a skateboarding engine with Pritt Stick

[@BrandNewByxor]

Nice man. I'm trying to write a QB decompiler (and compiler) for THPS scripts at the moment but it's difficult to figure out how the QB bytecode works. Did you ever work with QB scripts?

[@RumpIeForeskln]

Dude, this shit is surprisingly fun to watch even though all the actual learning just goes in one ear and out the other.

[@karanvasudeva5424]

But you will remember to detest the name of the House of SecuROM until the end of days...

[@GoulartGH]

or Denuvo, nowadays

[@NonTwinBrothers]

Getting highest possible score in levels (check) Increasing quality of videos (check) Analyzing the games code in detail (check) ExileLord is becoming the new Pannenkoek confirmed

[@fivepointt]

Wait until this man crosses QPU's with a guitar controller first.

[@HackaseSky]

Supah slayah With half of a note press, no less.

[@Geegs]

How to beat TTFAF with 0.5 strums

[@T3WGaming]

Soulless 7 confirmed to build up speed for 12 hours until the track launches into a parallel universe.

[@OfficialGlitchDoctor]

>tfw he actually puts in some pannenkoek memes during the directions part

[@mattb6001]

dude. not only are your software reverse engineering skills insane, but this video is incredibly well put together. you got my thumbs up.

[@Zaankiirah]

I'm too lazy" *Has been making sick update for 10 year old game that has a questionable community* Thank you for all these updates tho... I probably wouldnt even be playing gh3 anymore if it wasnt for your amazing patches!

[@Turtle_Pong]

This is incredible! It's almost like you have a love/hate relationship with reverse engineering this game. Congrats on getting this far, and thank you for all the hours spent for the community. I wanna learn more about coding in video games now.

[@BobBobson]

It's not the game that's the issue. It's SecuRom. If not for that this would've been a relatively quick and easy fix.

[@virgilsparda2505]

please take your stupidity elsewhere

[@virgilsparda2505]

KICKTHEBASSWITHTHEFACE! You can’t spell correctly so I know you can’t program

[@emoAnarchist]

why do you have to hate on the man, he clearly put more effort into this than you have. you claim you are oh so much better than him, why dont you fully solve the bug

[@mascot4950]

@KICKTHE..: What he did is literally the definition of reverse engineering. Namely the act of analyzing something in order to learn the details of its design/construction/operation. That the intent is often to create something similar, or to improve upon what you have reverse engineered, is separate from the actual act of reverse engineering. It's really all in the name. You can engineer (create), and you can reverse engineer (take apart something that was previously created). Using knowledge from reverse engineering to create something new, is just engineering.

[@coredumperror]

As a programmer who hasn't ever had to work at the assembly level (and hasn't even used a C-level language in well over a decade), I applaud you for explaining this well enough for me to follow along!

[@jamesdn12]

You are the Guitar Hero.

[@Morkeric]

can we all build a shrine to ExileLord

[@ZohondeKids]

BC Richard No, _A SHRINE'S NOT GOOD ENOUGH!_ we need to get this man a mansion _with_ a shrine.

[@makeitsweetsweetsweet]

BC Richard WE NEED MORE THAN A SHRINE! *WE NEED A SHRINE WITH A 50 FEET TALL STATUE OF EXILELORD!*

[@donnaken15]

Need to give him a job at Activision/Aspur

[@donnaken15]

+donnaken15 *aspyr

[@32th]

I want to like this comment, but it has 420 likes.

[@Wilker_uwu]

the bug was _exiled_

[@qrtrx4]

HaaH

[@g0dsm4ck100]

9:47 "Because I'm lazy..." after watching this, surely you cant be serious

[@g0dsm4ck100]

lol dude it was a joke, the fact that he's going through all of this mind boggling shit and then says, "Im lazy" is just ridiculous.

[@bakerdude06]

If you were a software developer, you would understand.

[@caughtintheweb0]

@@g0dsm4ck100 It's not though, for him, going through the process of evading SecuRom is a total pain in the ass, but simply fixing smaller things into he code is not. But making a counter bit of code to add objects to the text pool would take a fair bit of time and creativity, and he was probably tired from other work and didn't want to do it.

[@b0bsaget007]

99 problems and bugs in the code, 99 problems and bugs; Debug one down and patch it around, 117 bugs in the code!

[@EkosFoxLeviathan]

;' ) someone give a prize to this man please

[@JediMastr80]

Bethesda and Ubisoft follow this religiously.

[@litessbu]

This is the funniest comment I’ve seen in a while

[@GoulartGH]

in all seriousness though, this is really interesting; i assume a similar process goes for any reverse engineering process (especially for obfuscated stuff, like this). being able to figure out functions and methods from a seemingly random chunk of bytes is something i can barely comprehend, so reverse engineers (and people who deal with assembly in general) have my utmost respect. thanks for all the work you've been doing on GH3, and for this video.

[@ExileLord]

It usually isn't hard to tell if a random chunk of data is code. You simply try to interpret it as code at a few different places and see what you get. In a sane compiler this would actually be really easy since most code is surrounded by "0xCC" padding. Securom makes this more difficult since it throws in essentially "random x86" padding at parts. Also after staring at disassemblers alongside hex editors for a while you start to spot some patterns as well.

[@DJ_POOP_IT_OUT_FEAT_LIL_WiiWii]

Stack winding/unwinding is a pretty good tell, three sequential pop/push instructions and you're on to something.

[@admkbldwn]

"Yeah, after a while you just start seeing the Matrix and stuff"

[@kingawsume]

This, kids, is why we don't use SecuROM. It make people who want to make mods no longer want to. Seriously though, thanks for this. I have an old Kramer PS2 guitar and dongle, it's about time I got a PS2 to USB adapter and an eyepatch.

[@wildwest1832]

man this guy knows a lot about x86 assembler.

[@ChrizzxDness]

5:22 Defeat Gywn Lord Of Cinder on NG+ Ohh Exile, you sneaky sneaky man you.

[@JustZackster]

I'm crying. I understood like 5% of anything you said but I love you so much

[@blacklightgamer97]

I wish I could understand all of this.

[@7027-s6f]

blacklightgamer97 same

[@GoulartGH]

i can't believe plumato is fucking dead

[@zwingler]

wait, what ?

[@Wilker_uwu]

???????

[@GoulartGH]

he died in irma

[@Benobot99]

Is this a sick joke? Is Tristan okay?

[@Wilker_uwu]

i hope this is a joke :(

[@zZGzHD]

Your programming and editing is orgasmic.

[@ArkyonVeil]

I've watched this video time and time again over the years, as I learn programming concepts more and more of this inspiring video becomes understandable. Fascinating!

[@koyzumie]

This was so informative, thank you. I've always wondered what it was like to work the code of an allready compiled game. I never considered that they would put preventative measures into it to stop you. Impressive how you figured out a way around it anyway.

[@andrewmackenzie2638]

The preventative measures are mostly to stop people from cracking games and copying them

[@ExileLord]

They make it a pain in the ass for me anyways though even if that's what they say they're for. Denuvo and SecuROM are both incredibly invasive.

[@proaxel7003]

The main take I got out of this is that fixing bugs without the source code is a pain in the ass. And for that I commend your dedication!

[@BeyondOneSoul]

when skill goes out of control , good job

[@donnaken15]

2:45 That Double D constructor image. XD

[@beckybecky125]

5:28

[@bekahc2]

I have been playing vanilla Guitar Hero for years now and didn’t discover Clone Hero until a couple of months ago thanks to KZbin. I am constantly blown away by what comes out of your brain dude. Thank you for making the world an easier place to live in. ❤️

[@StephenChapman]

Excellent stuff! Your editing went a long way in making this type of subject approachable for everyone. I look forward to more videos from you like this!

[@Luyspa13]

Literally haven't played this game in years and have a very shallow programming background. Enjoyed every bit of this vid. Congrats, man!

[@PendragonDaGreat]

Around 260 songs? Array pointer overflow at 255/256 maybe?

[@ExileLord]

My guess is that they have an array holding 256 objects and that we're getting memory corruption when going over that.

[@PendragonDaGreat]

Yeah, wouldn't surprise me, and depending on where that limit is set it might take a bit more doing to fix that.

[@rogercruz1547]

Well... if they used a raw array and not a list object that should expand it's internal array when used properly... Just like they created a pool of text objects and didn't add more to it when it reached a threshold... What's wrong, activision? :(

[@chameleonedm]

Presumably because they want to know the exact compiled size of the game for retail purposes and aren't concerned with putting limits on a potential modding community (at the time)

[@DJ_POOP_IT_OUT_FEAT_LIL_WiiWii]

My guess is more or less than 256, most likely an arbitrary number like 400/300/200/150... This is a pool, there's absolutely no need to have the end of it aligned to the bus size. The programmer goal here is to estimate the maximum visible objects, make the pool too big and you're overspending on memory budget. It's not the kind of number that I would pick to align because there is no repetitive copy/read/write to that memory block. The number of song is quite irrelevant to the maximum number of text objects, some could be instantiated and hidden/culled from display.

[@redictor]

i recently learned that apparently the people that made securom made denuvo as well

[@CherryNobody]

I came onto KZbin tonight tipsy, I left with a new subscription to a impressive looking coder who I could still understand why things happened through the haze of alcohol. Solid work.

[@DennisGr]

from a computer engineer working for a certain seattle based e commerce and cloud computing company: the IT sector always needs competent people like you

[@Azortharion]

I know nothing about coding or programming and yet this video enthralled me all the way through.

[@JediOfTheRepublic]

dude, this was a great video. I didn't even realize Guitar Hero 3 has a major bug in it. Played it only on the 360 until that red ringed. Looking forward to what that next error brings.

[@ley3198]

Dude, the amount of work to fix a glitch like this is epic. You make me want to play the damn game.

[@LocalAitch]

Best production values since SArmstr0ng

[@doombybbr]

This DRM sounds like a great way to slow down the calling of the constructor to a crawl(really dumb design) and also a great way to cause random bugs. Calling a function a thousand times increases the odds that bits may be lost in the process.

[@ApexHardcore]

As someone who is not a programmer but personally associated with people who do similar work in the japanese arcade game scene, this was really fascinating to me to get an insight on how all the magic is done. Thanks for making this!

[@KimCheonGi]

4:40 In case you've never heard of SecuRom, it's a piece of shit that fucks with everything it touches.

[@doombybbr]

Just hearing the guy talking about it I am thinking "A few hours for a fucking function call? HOW DOES THAT GAME EVEN RUN!?" and "Sounds like a great way to ruin the job of your bug testers" and most importantly "I am pretty sure that doing something in such a long winded way would cause a whole lot of errors due to lack of communication between the game programmers"

[@DJ_POOP_IT_OUT_FEAT_LIL_WiiWii]

There's no evidence that the copy protection is hampering substantially the game here. Define long winded for a processor that handles a million instructions per second. The only sketchy thing that is called out in the video is using undocumented behavior of the x86 instruction set. More specifically padding the unused parameter part of instruction boundaries with garbage data.

[@littlebigphil]

Securom is probably turned off for debug builds.

[@doombybbr]

Securom could probably cause bugs and stalls, so not testing it is dumb.

[@littlebigphil]

If Securom is causing a bug they aren't going to be able to fix it anyway. I doubt it would cause stalls. From what he showed it did in the video, any stalling would happen only on first call. If there were any stalls they'd just look like loading time. If someone was really concerned with how it affected their code, then they could just turn it on when looking for bugs. When they find a bug they'd turn it off, and try and replicate the bug. If the bug stays they know Securom has nothing to do with it, and they can keep Securom turned off while debugging like normal. The same process works with performance testing, but if the performance issue left when they turned Securom off they could do something to fix it. They could just add a bunch of dummy calls to the methods to resolve the obfuscation ahead of time. Oh and if the obfuscation isn't deterministic, which it probably isn't, they might be able to fix a Securom caused bug just be reapplying it. If this is the case, then testing for bugs with Securom enabled would only make sense if it was a final build candidate.

[@victordarkes311]

Never was interested in my learning assembly in college and my professors didn't make it interesting but this video right here is fantastic! I love GH and you are an incredible dev!

[@DrewBrooksPB]

This is fantastic! I'm currently taking Assembly Lang. at my University, this is actually a great way to understand this stuff for people like me. You turned my procrastination into motivation for this project!

[@miskeeping]

You're seriously the hero of the community, even if not as many people play GH3 anymore, you did something fucking incredible. Awesome job, Exile. Love everything you do

[@dannieltaylor5833]

This is amazing! I am such a geek for this because I program here and there and dream of becoming a game developer, so when I see something like this I just don't know what to say other than how awesome it is. You, my friend, are great and have the patience of a saint, and some pretty awesome reverse-engineering skills.

[@imtheHoriZ0N]

I'm so proud of myself for being able to mostly follow what you were doing here

[@burretploof]

This is incredibly cool. I always wanted to learn a bit more about debugging and maybe fixing games but I don't even know where to start.

[@PrincessGrouchy]

This wasn't just informative, it was an entire saga. Thank you for this.

[@TheDeAngeloo]

i know nothing of code yet i watched this in awe and fascination. well done good sir

[@drepfawx]

actual legend

[@WojackToter]

Well that's cool, quarterbacks can also be file formats. You learn something everyday...

[@rankgh1597]

Wow! It would be great to include that feature in the Guitar Hero World Tour with the MOD All-in-One 2.0 and put all the songs in the same setlist ordered according to the type of game.

[@masterkeaton1000]

Thank god for the ELI5 parts. I understand coding to a degree but a lot of that stuff went straight over my head! Good work though ExileLord

[@StarGazerTom1991]

Please do continue this! I'd love to see what else you do to fix the new limitation!

[@nou4219]

Thank you for everything - Exile. We all love you, I mean it.

[@RayLJL]

I'd love just a series as well edited and informative for any game. This was super interesting

[@CeilingPanda]

Not sure why or what triggered this into my feed, but now I know where to go when I need to explain stuff like this to friends, great stuff :)

[@nothingness4136]

You got a kudos from Ilfak Guilfanov himself in his latest tweet. Amazing video, congratulations. Make a series on reverse engineering. Subscribed.

[@tchangity]

Some seriously impressive reverse engineering of the assembly code!

[@prvk3]

honestly, I always hated assembly but you make it look so fun ! props to you!

[@Hourglass36]

didnt know there was a bug and I'm nearing 100 songs now. thanks for not letting me be disappointed

[@stephenvernyi1683]

Young software dev here..this was amazing. Absolutely thank you, and keep up the holy work.

[@CookiePLMonster]

Excellent explanation and editing! Indeed, that's an usual day when modding/fixing GTA ;)

[@Loneeeey]

Dude.. you series need to begin a reverse engineering channel or series... This was amazing.

[@sarphog]

I don't play thid game, nor do I care about anything about this But the world needs more people like you. This is amazing, even for someone outside this kinda community. Well done

[@OmegaMemo388]

I have no clue what you just did, but I am impressed.

[@JoshuaLaquai]

"This is actually worse than useless." - ExileLord, 2017, on the verge of suicide due to GH3 being difficult "Crimes against humanity" - ExileLord, 2017, really hates the devs of GH3

[@nasanierulastname2997]

I looked up SecuROM, and it turns out the EFF and a consumer advocacy group "Reclaim Your Game" basically said "Fuck this DRM anathema" about it. Turns out it's made by Sony, and we all know how much of a hard-on Sony has for DRM

[@caughtintheweb0]

The thing is, that thing wasn't just worse than useless, it was bad AND useless. Because the int variable defined at the top of the function and the variable it returns aren't the same, so it gets the variable wrong and will cause errors. And the function itself doesn't actually mean anything anyways, so all it would do is cause problems.

[@Ornej]

11:40 Amalgamation 2 YES FUCK YEA

[@suchakreelaokom9494]

Right!

[@miksuko]

what

[@thunderthunder6568]

You sure know your stuff man. I can only applaud to you

[@pvic6959]

This was absolutely amazing and as a cs student, I am super jealous of your skill the only suggestion I have is to keep the text up longer for example the one at 3:47. I don't have trouble reading English and most of them were pretty fast for me so for non-first language speakers it would be too fast for sure again, just some constructive criticism, but the video was 10/10 otherwise :)

[@NDZ12345]

Please make more videos like this, really interesting to watch the reverse engineering process

[@greg7mdp2]

This is the best video on reverse engineering I ever watched - great job!

[@Zeldon567]

Where would I start learning stuff like this with the only coding language I've dabbled in being lua? This seems really interesting to me and I'd like become a programmer. To reiterate: Where should I start? Also, fantastic work on the video. Not only did you show and explain what you did, you talked about it in a way that was easy for a noob to understand and in a way that was entertaining. Serious props, man.

[@lilfrostyy8829]

Even though Clone Hero's rise in popularity has caused bug fixes like these to become less monumental, the work you do is still incredible. Especially when you have to get around DRM. Fuck DRM.

[@ScepticLlama]

hey dude, that is really awesome. As a programmer, watching this is just even more awesome. Keep up the work. You earned my sub

[@fullautorevolver]

Making these video is your calling you need to start making how to videos about this stuff, and get people interested in the basic! Very informative and put together video!

[@BombchuLink]

Even though I know little about C++ (or whatever syntax the PC release uses) and even less about Guitar Hero: With my very decent understanding of 86x I understood about 90% of what you said. Also the killer ending to your trials. I know that feel man, at least you somewhat made it better. :)

[@MajkaSrajka]

It is not only your knowledge of 86x, he is actually pretty good at explaining that if you don't know the details you can follow him anyway. Oh, and the legos in the background help lol

[@Kakerate2]

Always fun diving into a game to find out how it works right? The best part is that it would take a dev with source code like 5 minutes to fix this. Don't worry bro, I've spent countless hours debugging war3 lol. keep doing what you doing ♥

[@Waspinator1998]

I don't even play this game or know how to write code on such a complex and involved level, but this video was seriously fucking cool. Also, I caught those Vektor songs near the end. Great taste.

[@michaelodonnell5710]

Years ago I was in this deep so I salute you - nice work.

[@bidomo]

Very informative, even thou I'm unable to completely follow you in the explanaition I kinda get a good grasp of what you did in the video, god I need to dust off my books and start studying a bit

[@asovietpotato4934]

I have absolutely no idea what you just said.... BUT I LOVE IT

[@Drjebus]

That is informative as hell, and *very* digestible for entry-level coders.

[@ozzytenacious107]

I don't understand half of what you're saying because I'm a complete noob in coding but I get the basic principles and ideas of what you're trying to say. point is, this is fucking amazing and you're an absolute legend.

[@NonTwinBrothers]

Oh man, how much I've learned in the past 5 years. I can actually understand what you're saying now :D (Everything other than the disassembly workflow, that's still a mystery to me though) On the chance you feel this comment is worth responding to, quick question: At 5:14 Was the string "You Are Now Entering a Restricted Area" actually part of the rom?? If so would it be part of all SecuROM routines?

[@serraramayfield9230]

No. It's in green text, meaning that they're comments left by Exile/IDA. The function name "You Are Now Entering a Restricted Area" was set by Exile too.

[@NonTwinBrothers]

@@serraramayfield9230 You're supposed to read the code before commenting

[@michaelhebert7591]

Nobody notices he said slow ride expert has 511 notes, despite it having 551.

[@ryancallahan7845]

Legitimately amazing to watch. Well done, Sir.

[@patxs]

i love these types of vids from you, they're really good tbh also, nice song.

[@worldgeektube]

An absolute joy to see those skills!

[@Mati12Osorio]

You are our Demigod of the GH3! :D This really looked interesting btw.

[@davidmenlo9305]

This is an awesome video. Glad I found it. I've done some blind reverse engineering of file formats, I'm looking forward to a part 2 for that next bug :)

[@phi_the_whingy]

If anyone was wondering, these are the 'labyrinth instructions': At the first branch turn left. Ignore the next two branches. Turn right at the next two branches. Ignore the next two branches. Turn right if you see a rolling boulder. Otherwise turn left. If you reach a dead end try to climb over the wall. If there is a book on the floor, use it to derive Newton's calculus. Otherwise turn left. Keep going straight. Keep going straight. Keep going straight. Stop going straight, turn left but only if the path in front of you is blocked by a cog. Turn right. Turn left but only if your sign is Gemini. If your sign is Taurus let's just crash the game. Find a sloped angle under the gate and build up speed for 12 hours. Ask pannenkoek12 to explain parallel universes. Cross the gap with only 0. 5X A presses. Acquire a taste for freeform jazz. Defeat Gwyn Lor of Cinder on NG+ Find a guitar hero video without someone mentioning danny in the comments. Move up and down on the carnival barrel. Run to the room of the three gargoyles. Push in the right tongue. Go down the staircase into the wall climb. Race up to the observatory and spin the sundial. Pass into the room of the golden idols. Press down on the bases and enter the shrine of the silver monkey. Assemble the statue and head into the torch room. Jump into the elevator and descend into the mine shaft. Plow through the stone and enter the tomb of the ancient kings. Climb into the spider's lair. Escape and sit upon the throne of the pretender. If the correct door is unlocked, you may crawl into the pit of despair. Make your way through the cave of size back to the temple gate. Are you really reading these?

[@MaxYoung-Maxinfet]

This is Brilliant, awesome video, I hope one day I can learn to do this as well. I have only recently gotten into reverse engineering but this was truly awesome to see the thought process behind this fix.

[@oliverhilton6086]

This is like a crime mystery show but with code. I love this

[@SianaGearz]

I don't care about your other topics, but i'd watch everything on RE that you're willing to do.

[@killadog07]

Not a programmer at all. But I just want to thank you for all the work you've put into this game over the years. Much care my friend, try not to go too insane while fixing this! But seriously, thank you.

[@ActiveThink]

I dont even play this game or knew anything about the BUG but i watched the entire video and it was pretty interesting!! good work!

[@TheZenytram]

man, without you, what'd be of the GH community.

[@Peckadelic]

Incredible work. From a software student, this was sick.