How to reverse engineer your favourite game

In his spare time, Exellys alumnus Olivier likes to reverse engineer games. Though it is a very niche subject, his peers at Exellys were curious to know more about it, so during his tribe’s ‘Talk of the Minds’ (which are knowledge sharing sessions among Exellysts), Olivier gave a presentation on the subject. You can watch it in full here:
👇 ABOUT EXELLYS 👇
Exellys' single mission is to attract, develop and retain the finest tech talent in large and medium-sized companies and major tech start-ups. We incubate young tech talent into our customers' operations of today and we prepare them for the innovations of tomorrow.
Are you a student, recent graduate or a professional and are you looking for a challenge in IT? Or does your company believe in the potential of young tech talent? Let's talk!
👇 FOLLOW US👇
Website: www.exellys.com/
Blog: blog.exellys.com/
Instagram: / thisisexellys
Facebook: / exellys
LinkedIn: / exellys
Twitter: / exellys
TikTok: / exellys

[@marcelgraf5520]

I really wish you would also show the how you broke down the program into seperate assembly segments in your IDE.

[@zigaudrey]

Understanding the gear of the game and taking advantage of it is the most satisfying part of ROM Hacking/Game Modding.

[@bobbyaremyshoes2233]

Thanks, nice info. I didn't know that you actually don't need to understand code fully while decompiling. But there is one problem with this code-comparing approach. For example, the original devs could have different (much older) version of the compiler or even write the assembly by hand (from my experience handwritten code may drastically differ from the original). In that case by simply compiling with a modern compiler you won't be able to get the same output, especially down to the hash matching

[@moienahmadi2377]

Tools like Detect It Easy usually can tell you what compiler and linker were used to build the final executable.

[@valshaped]

As a heads-up, you can rename and retype variables within Ghidra, and it'll produce more correct/nicer output. You can also create data structures within Ghidra, and get even nicer output.

[@kaypunk9032]

Incredible! Thank you so much for sharing all of this information

[@luigi4204]

bedankt kerel! Ik zag toevallig dat je uit belgie komt. Er zijn niet veel nederlandse/belgiesche mensen die reverse engineering uitleggen en doen. Dit geeft mij hoop om nog meer te leren en ooit zelf ook te kunnen reverse engineeren. Bedankt voor de motivatieboost!

[@Reichstaubenminister]

Bedankt (?)! Ich sah zufällig, dass du aus Belgien kommst. Es gibt nicht viele niederländische/belgische Menschen die Reverse Engineering auslegen[/erklären] und tun. Das gibt mir Hoffnung um noch mehr zu lernen und selber auch reverse engineeren zu können. Danke für den Motivationsschub! If you don't speak German, are you still able to understand that? I don't speak a single word of Belgian but I still managed to read your comment because the languages are so similar, haha!

[@luigi4204]

@@Reichstaubenminister yeah. i can read all of it 😅

[@fleecky7011]

Heb advies voor je, leer eerst C/C++ goed genoeg snap hoe pointers werken en daarna leer assembly x86 (eigen ISA) daarna vind tutorials op hoe statische analyse met IDA/ghidra werkt en probeer een paar crackme’s te doen. RE leren is veel praktische ervaring op doen en veel proberen. Goed advies is ook godbolt/dogbolt gebruiken voor interactieve deassembly en eigen C/C++ apps maken en dan de asm lezen en snappen hoe de structuur in elkaar zit.

[@JustMLC]

Nederlands 🇳🇱

[@LunaJLane]

I would love to see the process of going from game files to decompiled code that we are seeing in this video.

[@Expresso52]

What is the general process for figuring out what each function does? You mentioned giving some functions a name, that matched their functionality, but I can imagine the decompiled C code bring pretty general like the example you gave. Do you just mess a little with the functions and see what happens after you rebuild, or do you have a better approach?

[@Meta_data]

This was amazing, thanks so much for posting it.

[@roisoleilxiv14]

There is a compiler explorer extension for VSC ;) Thank you for the good presentation!

[@elonmust6473]

This is a very good lesson for beginner to learn.

[@razorblade413]

very informative video. It could be cool if you do a tutorial video taking the same mario kart but starting from zero to showing each step of how you decompile a first function from assembly to c.

[@5persondude]

It’s funny that you mention Mario 64 being ported to PlayStation consoles, because even though I’ve played that game numerous times for many years now, the first time I got all 120 Stars in that game… was on my Vita 😂 also not a bad time to mention that I got all 120 Stars in Mario Galaxy for the first time on Steam Deck

[@lyomgames]

Awesome video man thanks

[@ElPsyVega]

it's possible to access the models and textures of a game without programming knowledge?

[@jamesking2439]

There's a tool called Ninja Ripper that can do this for DirectX games.

[@awii.neocities]

Depends. Some games give you complete access to them, others have them in a completely proprietary file format

[@aa898246]

really useful video

[@ThatBigDon]

Great video brother.

[@plasmasupremacy9321]

It was nice to see your process! thanks

[@jh5124]

This was fascinating. Thank you.

[@MuteObserver]

Thank-you Exellys!

[@elrisitas8508]

how is he building the rom from asm and c code mixed?

[@renanmoura2168]

Do you already know the answer ? I'm looking for it too

[@elrisitas8508]

@@renanmoura2168 he has must have a specific makefile, but this is beyond my knowledge

[@deanvangreunen6457]

The compiler, c supports inline assembly. But yes, a special makefile will work too.

[@khatdubell]

Interesting approach

[@martinbean]

@Exellys I’m familiar with opening a binary in a reverse engineering program like Ghidra, but how do you get .asm files from the binary that I can put in a folder and maybe share so others can collaborate on decompiling a game?

[@jorisstudios6506]

a mention of the efteling!? wooooooooooooooooooooooooooooooh

[@jorisstudios6506]

wait a minute... are you dutch?

[@GustavoRicci-vj2qt]

Cool

[@moremikeyjames]

Awesome Video!

[@Falstad88]

How did you know that the type was "char"?

[@ryonagana]

1 byte is always char 4 bytes can be an int (32 bits) lots of 1 byte aligned is a char array

[@v0lts]

how are you compiling from assembly and c at the same time?

[@antiimperialista]

inline asm is supported by a lot of compilers and linkers

[@v0lts]

@@antiimperialista interesting, thanks for the reply

[@BALtimore2001]

I'm looking to decompile "Nicktoons: Battle for Volcano Island" on the Nintendo DS to then port it to other platforms.

[@soraaoixxthebluesky]

Is it possible to decompile or to reverse engineer, say a PS4 games .exe to get an approximation of how an actual source code look like and build a port from there? Say run PS4 exclusives on jailbroken consoles like PS3 or Xbox 360 wiith cut-back here and there for final version. Ignore the performance, can we make it run at all at say 10 fps for first iteration (v1.0)?

[@Zippy_Zolton]

noh

[@Tygo69]

"PS4 games .exe" are you ok?

[@isaiahkern9434]

none of the comments here are that informative. For clarity sake, the OP is unaware that .exe is specific to windows, but I believe the intent was to refer to the program/game's code being ran. I'll just refer to it as execution format) As for OP's question. Which I'm taking as "could a ps4 game run on a xbox 360 or ps3, if it was reversed engineered converted to source code. then compiled for 360/ps3" On paper, sure, maybe. In practice it's way more complicated, and could be a no. For example, someone is working on a port of legend of zelda OOT to a ds. The ds on paper is technically "weaker" than a n64 if we're just talking raw clock speeds. But due to what in the hardware, and specifications, certain tasks can be done faster than then n64. But that's the problem, you need someone who not only knows enough to reverse engineer a ps4 game, but someone who also knows the in's an outs of the target console. And there are likely some tasks that just, cannot be done on a weaker system (at a reasonable framerate)

[@soraaoixxthebluesky]

@@isaiahkern9434 thank you so much. I thought ".exe" executable file was universal to all machine. didn't know the it is a proprietary executable file format for windows.

[@isaiahkern9434]

@@soraaoixxthebluesky of course, no problem. If anything, you may want to look up and into what assembly is and how it works. And the relationship between a executable format (start with a windows .exe) assembly programing, and operating systems (like windows) is it will take a quite a bit of time, but it will help prevent scenarios of getting effectively laughed at. Which is pretty rude.

[@JonelKingas]

i would realy want to look at warzone code cause the game is so bad, you can think of 10 problems and 0 good things... servers cheap, developers probably cheap as well cause such bad game, crashing, lagging, lagging whole PC in alt tab, constant bugs as example when already landed get teleported up as if landing again in plunder... its so bad... always 99% GPU and low fps while game looks like 2005 game on all low

[@firstclass000]

This stuff is so complexed and I dont even know how to read C# or C++

[@WayneModz]

C# is something you can learn to read in a few days

[@Tygo69]

@@WayneModz😂

[@epik4023]

​@@WayneModz😂

[@MrEucalyptus47]

Did you think games were written in plaintext essays or something

[@championazertyuiop3953]

Honestly it’s very simple to understand and modify c# decompiled executables for simple tasks like removing the health logic

[@koldx111]

How can you reverse engineer internal cooldowns? For example, reload times for FPS games. I mean down to the milisecond, regardless of framerate. Could record a video but wouldn't the framerate of the video mess with the actual in-game timer?

[@ougonce]

You could reverse engineer the animation files and figure out how long it is from there, but recording a video and counting the frames is the easier and more reliable option

[@tahargermanni6205]

@@ougonce Hi, could you please help me to bypass the registry of the app that the manufacturer of this software is not existing anymore

[@jh5124]

This is a great video. It could have been a fantastic video but it took you 21 minutes to get down to brass tacks. Introductions for yourself, what reverse engineering is etc is fantastic. But you must be more succinct. The intro shouldn't be longer than the meat and potatoes.

[@antiimperialista]

it reads like a work presentation

[@Teja-vx6xm]

Bro can you change bluestacks emulator tweaks ???

[@GustavoFerreira-ed1kn]

In Ghidra is possible dump and rip 2d sprites and 3d models from any games consoles to pcs ???

[@darthvaderbn]

No, for 2d game, you (mostly) have to use an emulator with debug tools. But with 3d assets it's complicated, older games (from 5th generation to 7th) use different extensions for models (for example: super mario sunshine models are easier to dump than mario party 4-7 models)

[@TCperry]

Jesus loves you!

[@younessamr6802]

does anyone knows the reste of the compiler options: emerald_new_agbcc -O2 -g -m.....