Fixing Multiplayer Of A 25 Year Old Game

In this video we reverse engineer the networking protocol for Worms 2 to see if we can fix it.
For details on the community patch and accessing the official servers please join the Worms 2 community discord / discord
💭 All views are my own 💭
Worms 2 networking protocol: worms2d.info/Network_protocol...)

[@keiyakins]

Team 17 apparently agreed with you that this was overly complicated, because in Worms Armageddon they ripped the whole thing out and replaced it with an IRC server with some HTTP apis

[@RobotnikPlays]

I was honestly wondering if a potential solution is to just patch out some/all of the network code with a more modern implementation, rather than trying to stand up an ancient server list/join protocol

[@halfbakedproductions7887]

Honestly, that is probably good enough for a simple turn-based game like Worms. There isn't any serious real-time updating required - just push the data to the other client and let the client game "play back" the action as if it were local real time. IRC is grand, as you could just encapsulate game updates as some kind of text-based chat message. On a game like Worms, you don't have to worry half as much about things like keeping physics in sync, client-side prediction, pings and latency management etc.

[@keiyakins]

@@halfbakedproductions7887 Once you're actually in-game it uses a different protocol connecting between players directly, it's the matchmaking server that uses the IRC+HTTP thing.

[@dieSpinnt]

@@RobotnikPlays Nope. Nathan's method of emulating the original server is the least invasive. Actually it is non-invasive, so no one has to patch a client or juggle some versions around or add some DLL or stuff ... which leads to all sorts of horrors and uncertainties and frustration, as we know from history. I believe you had good intentions, but by adding additional dependencies and excluding the original clients (and with that: time travelers .... hehehehe) you go down the path to the dark side ...:P P.S.: Some of those projects reviving the network capabilities of our old beloved games can take years or over a decade to get into a working state. But who cares? Let's rather pay our respect: F. Well, and at all: That is part of the reverse engineering fun;)

[@publicacct5626]

This is some of the most accessible reverse engineering content on KZbin. Thanks! Do you keep any notes while you're doing this work? For me it's essential to have a text doc of discoveries and to rename things/add comments to the decompiled output.

[@nathanbaggs]

My aim is to try and make things like this approachable, so I’m glad that comes through. My usual approach is to do most of the RE ahead of time and aggressively keep notes, I can then script up a video with a clearer narrative (and cut out most of the bits where I just stare blankly at a debugger hoping for inspiration)

[@stevobox8726]

Dude you’ve got a knack for this type of content. I could watch these all day. Please make more!

[@Woohoojin]

11k subs is criminally low for how entertaining you make such a frequently frustrating process look. Glad to have stumbled on your channel!

[@nathanbaggs]

Glad you enjoy it!

[@pkalman2045]

oh coach banan is also interested in comp sci? and yeah if he just keeps up this quality at least a 100k is to be expected, truly outstanding content

[@stevobox8726]

Sitting on 14k now, this channel could be huge

[@junebug9320]

3:50, finally my go-to solution of screaming into the void has been validated

[@nathanbaggs]

Sometimes that’s all you can do

[@damianabregba7476]

When you scream into the void, the void screams back at you

[@Maric18]

don't just scream into the void! screaming is a great catch all experimental interface method random people ask you to sign up for things on the street? SCREAM computer wont start? maybe SCREAMING fixes it its 2 minutes before clockout and your boss walks in with more work? GUESS WHAT

[@santypk5]

Please continue making this kind of videos, your work is truly amazing

[@LightTheMars]

Great channel. I've been randomly recommended your Roller Coaster Tycoon video and I can't wait for more content like this. I've dabbled with reverse engineering in the past with Ghidra and x64dbg, it's really interesting seeing how to use them in tandem like you do.

[@ChrisRodger87]

Marvellous and inspiring. It's fascinating to see problem-solving at this level. I recall only having to produce one pretty simple program in assembly at university - we all had a mortal fear as students, lol. Most of us thought Java was a tough cookie to crack! Your fluidity and mastery blows my mind!

[@joshxwho]

This is a fantastic introduction to reverse engineering, glad KZbin recommended me this - I already know the tools but always love a good reverse engineering story.

[@Frrk]

Awesome stuff. I have fond memories of playing Worms 2. Online, people mention Armageddon or WWP more often, but I always felt that those added too much convoluted stuff.

[@sandwich2473]

This is a really really interesting project, thank you for going through the process and showing it to us :O

[@metalpachuramon]

I watched the first part yesterday, so glad that the algorithm blessed me with the fresh upload! Keep up the good work mate

[@xdan0x]

Met too! KZbin at it's best

[@JRDavison]

Mate, this is unreal. I've learnt so much. Thanks heaps for making it. I glad it's you and not me though, looks pretty tricky.

[@hajimemash1375]

Best video that finally made RE seem practical and not some black magic! Aside, distance to camera seems decent and moving it back a bit may be even better [the closeup one].

[@axelqt1]

i'm in a similar process with a game that closed more than a decade ago called Infinity online, thanks for all those precious informations

[@Jango1989]

Brilliant video. I love your process and your explanations are really good too

[@codenamegamma]

something that could really use some help is Sonic R, the main version we use from 1997 doesn't have the netcode that shipped with the original release, so the original version for networking just won't run at all, so while the game did support networking at one point, it's not something anyone is working on sadly. this is one of those things where if it could get working again the community im sure would use it.

[@Pikmeir]

I'm not a programmer so I understood close to 0% of what you were doing, but I still loved the video and especially loved how somehow this game is still being played. I'll have to dust off my Worms 2 CD and give it a try!

[@migueldellicarpini4437]

Wow thanks for bringing back so many good memories, besides this video encourages me to go back to low level tinkering just for fun. I'm eager to watch more content from you about this masterpiece of software.

[@TheJaber288]

What a nice channel, you deserve more subscribers, very nice explanation and very logical to follow, maybe you can show more in detail some bits of the workflow in ghidra ?

[@Barrytown69]

Wonderfully enjoyable content for a programming novice like myself!

[@christopherbennett1173]

This channel is a true gem.

[@sanderbos4243]

Loved it, thank you for the follow-up!

[@Scarhandtunes]

This is unreal stuff mate, just seen the first part recently too! Subbed for sure

[@nathanbaggs]

Thanks!

[@KingMoronProductions]

No this is Worms, not Unreal 😆

[@Scarhandtunes]

@@KingMoronProductions any more of this and I'm unsubbing! 😂

[@timeimp]

Subbed. This video was great!

[@louisparry-mills9132]

Awesome, a really cool idea for a video. I can't wait to watch it all when I get a minute o.o

[@Yetiwizard1]

Amazing content, superbly presented! I really hope there's more to come :) Have you tried using Ghidra's debugger? I don't have experience with it myself but it might make it easier to debug alongside the decompiled code and all the info you've documented.

[@nathanbaggs]

Not yet, just been sticking to what I know. I also think it provides a bit of visual variety in the video

[@shakeuk]

Love the content, keep it up

[@lefthookouchmcarm4520]

"We can't just stare at these bytes and try to divine some meaning from them.." Rofl. This was probably funnier than it was supposed to be 😂😂

[@Bobbias]

I'm curious about the function you identify at ~5:40 How did you identify that it takes 2 parameters? Was it purely by looking at the assembly rather than the decomp? And is there a reason you're not renaming and correcting the decomp?

[@nathanbaggs]

The decompilation of the function showed two args, I think I might have cut that out to zoom into the actual code

[@xy-box]

He use IDA decompiler instead Hydra 🤣

[@bobbyaremyshoes2233]

It would probably show the real number of arguments during the actual function decompilation. Ghidra only decompiles a function if it's actually opened. What you see in the video is just a guess based on the passed arguments. To be able to see the real arguments (or rather another guess based on the internals of the function) at calling sites, you need to decompile that function and commit its parameters ('P' by default). If I remember correctly, it's done automatically while renaming a function or its parameters. It's strange he doesn't do it, being able to set comments and types is literally the best feature of tools like Ghidra and IDA

[@Bobbias]

@@bobbyaremyshoes2233 I've used Ghidra myself for a little while when attempting to recover the source code to several functions in an old game (Enemy Nations), so I'm somewhat familiar with Ghidra at a basic level. I had the benefit of source code to work from, which made identifying various functions far easier, but the decomp definitely didn't always get things right. vtables in particular were a nightmare to reconstruct (I never tried automating things or using the header parsing features though). But yeah, it just stuck out as weird to me that there was absolutely no visible use of any of the functionality Ghidra exposes in the video.

[@robert-yates]

stare at bytes and divine some meaning from them sounds like a good job title

[@NeverGiveUpYo]

Epic. Finally some interesting content on the tube. Thanks for this.

[@zenguru84]

Thx for letting us in your brain and way of thinking. You are true ninja.

[@TomWhi]

Mega interesting! Looking forward to watching more. Thank you algorithm.

[@djstrickson1284]

I like this video a lot. As a computer scientist with a specialization in distributed and networked systems, this is very well-explained. For me it would be more interest to see the connections between the output of the "real game" and the ghydra assembly. Maybe you can show the path, how you see the details to follow back the path and the find the values and functions that are important ? :D Thank you

[@generalkilbabathemadmansch3602]

Very informative! Thanks for the video.

[@liqzz]

just saying that your work wasnt for nothing. i am currently learning about networking and IT in generall and this video really helps to understand the inner workings of a simple multiplayer funktion really good and understandable. also i really like the editing. thanks :)

[@poison812]

Watching this brings back very old memories

[@ricardonacif5426]

Keep it up. Great content

[@UndeadAlex]

Oh its a good day when Nathan posts ❤️

[@haxguy0]

Your content is marvelous

[@vonBlankenburgLP]

Absolutely great content. I've never seen one presenting how to reverse engineer code on KZbin with so much detail. Subbed!

[@HinkHall]

This video really makes me want to finally dive into the code of one of my old favorite now delisted/offline titles of Spartacus Legends...

[@nicholasholmes197]

I would absolutely love if you could fix lego rock raiders. Such a nostalgic game that I cannot get to work for the life of me.

[@snooks5607]

title talks about "fixing" but the video seems to be all about discovery, apparently the context for this video is in prior videos, it might be worth mentioning that somewhere

[@MidtownMadness1]

I have yet to watch the video, but I'm sure it will be a good one. Is Midtown Madness also a childhood game of yours? A lot of the exe has already been reverse engineered (see Open1560). I have been wondering lately how difficult it would be to upgrade some of the network libraries they used back in the day. As currently, it visually appears as though the player's network data is only updated a few times a second.

[@xtomvideo]

That's fascinating and impressive.

[@terryjbutler]

Wonderful stuff!

[@JamesTDG]

Kinda sucks that your journey on this project is over, but it is nice that it was finished at least

[@jackdeespadas]

A wizard in action. Thank you for the interesting content.

[@injurera]

It is a lot of FUN with all those FUNctions.

[@Diogenes_von_Sinope]

oh the memories... in our local computer club, we had a worms 2 Lan tournament. i made 2nd place. won a copy of quake. :D

[@whynotanyting]

The thought of yelling at something to potentially get an answer is hilarious

[@xymaryai8283]

i wonder if this kind of thing is what the Northstar Server and Client team for Titanfall 2 had to do, its interesting to see the gritty details that make it clear why these things are difficult, but still possible.

[@ElmoLovesYou2]

well, it's possible to create OnlineServer for marioKart8 on switch - for play without subscription?=)

[@nordgaren2358]

I haven't finished the video, yet, but did you try editing the function signature of the function that was only showing you one of two arguments being passed?

[@nathanbaggs]

Nah I just powered through (:

[@verm_ms]

how long have you been doing this stuff? it's so cool (sorry i don't understand this stuff so i don't know how to verbalize it)

[@nathanbaggs]

Ive been doing forward and reverse engineering for about a decade

[@L3D451R7]

Hello. While watching your video i couldn't resist hopping on my disassembler and looking in worms main executable. There is 605 references of "OutputDebugStringA" logging which probably would be useful in your research since i noticed a bunch of DirectPlay debug strings.

[@joachimm81]

Is it local network multiplayer? Have you tried spinning up two instances and watching how they talk to each other?

[@DerSolinski]

Just for digging this old gem up you get a 👍

[@57F.K]

Do you have any recommended resources, for example books or websites, to learn reverse engineering?

[@velox__]

Really great work! Both the hacking & the video.

[@unknowntotherestoftheworld]

NGL i thought this was going to be about reverse engineering worms as in the malicious software type, used in the spreading of malware on networks. Even though the video is on something else entirely it was still worth the watch :)

[@CoreDreamStudios]

Is it possible to do this for a game which has SSL cert inside it for networking ? (server-client).

[@TeamUnpro]

nostalgia Before this vid: alright im done coding today, was a nice long coding session, but gotta take a break *sees this video*... Hang in there brain

[@AlexKiraly]

What an underrated channel - Reverse engineering has always been on my bucket list, but I never have the time to discover these things on my own. This content is literally a strong push towards my dreams, thank you!

[@Povilaz]

Very interesting!

[@TheRealZeaga]

It's baffling to me that you only have 18K subscribers!

[@e102em]

Are you able to fix the de sync on cities in motion 2?

[@shawnio]

I have to say this is basic stuff but it's very interesting

[@enterrarte]

thank you kindly for interesting video

[@soup9911]

oh SHIT he actually did it

[@darrenfalconer3267]

Did what?

[@nathanbaggs]

(:

[@johanngambolputty5351]

Hmm, I've always wanted to get into reversing, but not sure how doable it is for windows games on a freedom loving OS (and how much windows-specific knowledge is required)...

[@waldmensch2010]

nice work

[@jamesread11]

So how is the discord community playing the network version? Have they all hacked the app too?

[@Fewnity]

I want more videos about RE worms 2!

[@67steinip]

Although I love worms and your enthusiasm and skillset in resolving Worms 2, I wonder why 2? Why not Worms Armageddon, that to me was the best Worms and only because I hated the damn Magic bullet, it was way to god damn strong. Anyway Worms Armageddon is readily available and works already for newest OS's, so is it nostalgia? or is it just the interest in getting it done, curiosity :)? love your content though.

[@CharlesHydronium]

Armageddon's servers are still alive, in this case it's nostalgia

[@halfbakedproductions7887]

This looks like old fashioned, direct Winsock function calls and everything built from scratch. I can see why that made sense at the time and for this kind of application, but nobody really does that anymore.

[@bubbleopter]

I'm battling to understand how you manage to run two separate processes listening under the same port number, I'm really new to this but I've experienced issues when trying to run services on Linux at least when they share the same port number there's always been an issue.

[@nathanbaggs]

The server is listening on that port and the client is connecting to it, so there’s no conflict

[@bubbleopter]

@@nathanbaggs but what about the python script, how is that able to process the traffic as well? or is the python script acting as the server.

[@nathanbaggs]

Yes the python script is the server

[@57F.K]

Please do not stop making these videos, they are great! You will definetly get the attention you deserve 👍🏼

[@rogo7330]

When you stuck at client not sending anything to server my first thought was that server must send back how many bytes of the next message it will read. This is what SSH does for its channels. But I guess it is not necessary in here since all possible data is structured and expected to be meaningfull.

[@TheBitPunch]

I relate to how he looks at the end when he turns off his camera. No explanation. Deal with it.

[@nathanbaggs]

That was an accident (: just didn’t want to rerender the whole thing to cut a second off the end

[@SpinningPsycho]

This. 🔥

[@LawrenceTimme]

I used to play this game all the time when I was a kid. 😎

[@cougar-town]

You discovered the byte for the flags, that's pretty good. I'd assume it goes from 01 to 10, or longer to maybe X amount of flags so it might end up at like 20 or 30? not sure how many flags there are but, at least you've gotten some progress in. Then you could write a packet-like thing like this: packet { var flag_byte:0x02; type:mumbo jumbo; ... } This might be the way to reply to the response or something like that to ACK (acknowledge that the packet is received via TCP/UDP.

[@prahjister]

The first multiplayer game we got to work was 688 Attach Sub

[@StatueSounds]

If you want to have a poor round of worms 2 let me know!

[@2xAA]

This is very cool, though O != 0 ;)

[@calvinthedestroyer]

What is geedra?

[@rimmersbryggeri]

Bought this game for my stepson. His brother wouldnt let him play the playstation so Ihad to give hime something that was his to play.

[@taureon_]

okay you gotta be a new channel, cuz there is no way you only have 12k subs

[@Kakerate2]

5:45 can you explain how you know it has 2 parameters?

[@nathanbaggs]

I could see from the dissemblly of the function itself, sorry for not making that clear

[@CharlesVanNoland]

ws2_32.dll is the Winsock 2 DLL.

[@fireattack1]

I believe you meant 20 thousand (20s) at 5:22

[@nathanbaggs]

Good spot (:

[@nn-zp4ig]

Magic

[@TomTheEnglishPicker]

Hi Nathan. If you interested in some old cd / dvd based pc games get in touch. I buy and sell them as part of my business and would be happy to send you a box full over for free to have a play with. Sadly most these days aren’t worth much as the common consumer struggles to get them to run on current windows . Just thought I’d offer and even if most is over my head I enjoy these videos . 😊

[@Gaiwwie]

When will Cyberpunk get multiplayer

[@mandeeprai9818]

I don’t understanding one fucking thing but great video

[@amaanqureshi1286]

😀😀

[@christianpyn]

Any reason you didn’t mock out a server at the same time? You already knew what the server was sending, so why not send that and trace what a correct response looks like?