Reverse Engineering/Game Patching Tutorial: Full Res RollerCoaster Tycoon with Ghidra+x64dbg+Python

[@das_evoli]

I have no idea why this looks so fun to do. You feel like a damn detective

[@jeFF0Falltrades]

Same thrill of solving a puzzle (and/or crime - especially reversing malware 😁). Thanks for watching and glad you enjoyed!

[@MatVeiQaaa]

I am doing a bit of that stuff and it actually feels like treasure hunt, like you are in some fucking mysterious ancient catacomb solving its mysteries lmao. Very fascinating.

[@MatVeiQaaa]

@Abraham Johnathan I had this idea for a while, but the issue I have with that is that it’s just a game. Usually I solve some actual problem which people need to be solved with what I’m doing.

[@MatVeiQaaa]

@Abraham Johnathan Easy to get in to, ridiculously difficult to master :) It's a great thing to do, good luck and have fun!

[@KaizenWebDev]

Enjoy the "fun" while you can

[@siljamickeify]

I LOVE that you keep your mistakes in the tutorial!! It is soo valuable for a learner to see what is difficult even for the teacher! Wonderful tutorial, both in content and style.

[@jeFF0Falltrades]

I do believe in keeping in the mistakes and identifying them because it helps me learn too! And it’s true, there’s always so much to know and learn that there are bound to be mistakes, and that’s okay - I really appreciate when someone corrects me and helps educate me. Now that said, I would be lying if I didn’t say I also edit out a couple of hours of mistakes like my voice cracking, me cursing because I forgot something or misspoke, me forgetting to turn my phone off, me blanking on a keyboard shortcut, etc. - Y’all don’t need to know how much of a mess I am personally 😂

[@siljamickeify]

@jeFF0Falltrades if you edit out a lot, then it is even more impressive! The bits you left in are not only important to give a general sense of something being hard. You actually show the process of gaining information. Otherwise it is easy for a beginner to dismiss the teachers process as just being magic, I.e. there is no process, you either get it or don't get it. That can be so demotivating! But you show the process, which is truly motivating. "I can also do that! Maybe even a little bit faster than the teacher!"

[@RandomUser2401]

@@jeFF0Falltradesso the issue where the game was only painted/rendered in tiles resolved it self automagically with the patch?

[@jeFF0Falltrades]

@@RandomUser2401 So some spoilers, but I’ll actually be talking more in depth about this in my upcoming vid - I realized we didn’t really dive into the “why” behind the blackness shown in the intro in this vid, but in short - yes, the patch fixes the error, and the reason we see that blackness is due to the screen not being refilled with colors properly after the window is destroyed if the max resolution of the machine is bigger than the max threshold expected. More details to come 😉

[@RandomUser2401]

@@jeFF0Falltrades wow, so nice! That‘s so much more than the best answer I could‘ve imagine. Awesome, looking very forward to this video! Keep up the great reveng videos👌🏻

[@tov7913]

1 and a half year later and it is still a great video! I always wondered how patches for older games were made and this video literally answers this question on point!

[@jeFF0Falltrades]

Thanks for watching!

[@jatodd3746]

Now 3 years since video release, and still great.

[@NavnikBHSilver]

I have very little experience with assembler code of any kind, yet as a dev, and with the way you explained it, it was actually fairly comprehensive and mirrors a lot of typical high-level debugging, except you're dealing with unknown source code. I am likely not going to use what you demonstrated here any time soon, but knowing it is an option, and a path I could take if I feel dedicated to a goal, is very cool and exciting.

[@jeFF0Falltrades]

That is awesome feedback, Navnik - As long as you had fun and came out of this having more knowledge than you started with, I am more than happy. If it comes in handy for you some day - even better! Thanks for watching!

[@tahargermanni6205]

@@jeFF0Falltrades Hi Jeff, could you please help me to bypass the registry in app that the manufacturer is not existing anymore.

[@toweri_li]

The first time I am watching how an executable is debugged / patched on Windows - as opposed to Commodore 64 ROM in late 80's - and I actually understood this! This speaks volumes on your capability to explain a fairly complex process to a 100% genuine noob in undestandable way! Go ahead, pat yourself on the back. You truly deserve it! :)

[@jeFF0Falltrades]

Ah man, thank you so much for the kinds words! So glad you were able to get something out of it; Thanks so much for watching!

[@Eirenband]

What a great video. So far this is the only RE video I've come across that showed a full and concise analysis with a working patch at the end.

[@jeFF0Falltrades]

So happy you enjoyed it! I have a new vid cooking now; Hoping to upload by end of Jan :-). Thanks so much for the kind words.

[@steventwigg2369]

The intro montage of Roller Coaster Tycoon deserves an award.

[@StefanNoack]

34:27 you forgot to convert to decimal. 0x20 corresponds to the border size (entry 32) not the scrollbars. Which also explains why the value is doubled, since borders are on both sides. It doesn't matter, though :)

[@jeFF0Falltrades]

Thank you! Someone else pointed this out and I totally did - I even said at the start of that segment “These are the values in decimal on this page” or something 🤦‍♂️ I edited the description a while back to include this correction. Thanks for watching!

[@dracenmarx]

It was very entertaining to watch! Just one improvement suggestion: It would be good to name variables, functions and memory addresses in the moment you identify them. Then the code browsing in Ghidra is much easier.

[@jeFF0Falltrades]

Thank you for the candid feedback! Others have remarked this on this particular video and it made me realize in retrospect that I missed the opportunity to do so in this one (I was so excited to publish this as my first vid that I think my mind was all over the place). That said, I’ve tried to improve that in my other videos so I hope you’ll find the feedback well received! Thanks so much for watching!

[@RandyFortier]

Great video, and very interesting to see the process. One recommendation would be to change the names of the variables and functions in Ghidra as you go. It will make the program become more readable over time, as you discover what everything does.

[@jeFF0Falltrades]

Thank you Randy! Yeah, this being my first one of these videos, I failed there, likely due to overexcitement 😁 - this was one of the primary pieces of feedback I got for this one, and I took it to heart. Happy to say I’ve gotten better with subsequent videos. Thanks so much for watching and for the kind words!

[@RandyFortier]

@@jeFF0Falltrades It is pretty rare to find this content, so I was glad to find it. The quality is very good! I look forward to watching some of the other videos!

[@jeFF0Falltrades]

@@RandyFortier Thank you so much! And agreed; that’s really why I’ve kept with it. That and the incredible community that’s been built up around it :-)

[@jeFF0Falltrades]

Hey everyone and thanks so much for watching and for all of the great feedback! Please be sure to check out some of the other comments for tips, resources, and submitted feedback. I hope you enjoy!

[@padwan1000]

Hi, awesome video. I like to ask you where is a good place to really learn C language. I think C is so cool but the learning process, at least to me had been painful, as you have much more knowledge you have to know a good resource for better learning from language. Thanks.

[@jeFF0Falltrades]

Hi Marcos, and thanks so much! I put a few resources in the video description here, but it depends on how you best learn: If you learn better through videos and a university-course like environment, try Harvard’s CS50 course: cs50.tv/ If you prefer reading and self-learning, this is a good book as well: C Programming: A Modern Approach, 2nd Edition www.amazon.com/dp/0393979504/ref=cm_sw_r_cp_api_glc_fabc_UGX8Fb9B8FBGF Also be sure to check the resources I posted, as a few of them have lists of other resources. Hope that helps! Thanks for watching!

[@padwan1000]

@@jeFF0Falltrades Thanks for your reply and a book recommendation, I like to watch some teach classes in video, but I don't refuse a good programming book. I'll take a good look at this book and let you know what I think about it.

[@padwan1000]

@@jeFF0Falltrades Hi, again. There’s another hacker channel o even another hacker resource which you recommend I follow to get more hacking knowledge? Any recommendation will be welcome. ps: the book that you was recommend is awesome, pleasure reading and easy to understand. Thanks.

[@jeFF0Falltrades]

@@padwan1000 Hi again! I always like to recommend Colin Hardy's KZbin channel - He's been doing this a lot longer than me, and he's brilliant at it.

[@pedrogabrielnogueira1068]

I'm just saying what i think of the beginning of the video: This looks amazing. You are going to solve a real problem for a game with patching. Awesome. Valuable content.

[@jeFF0Falltrades]

Thank you so much! I hope you enjoy this, and if you do, I hope you enjoy my other vids - which arguably have only gotten better in quality with time (not by much but I’d like to think a little 😂) Thanks so much for watching and for your kind words!

[@naveenjkondeti4214]

Nice, Always wanted to get into reverse engineering. Seems like starting with videogames could be fun way to start..

[@jeFF0Falltrades]

Thanks for watching! Yeah, that’s partly why I wanted to start with this problem - it’s a bit easier to wrap your head around than starting with something like malware analysis. I hope this is helpful to you!

[@ricardonacif5426]

Guidedhacking.com is a great start for that.

[@AlphaYellow]

I have a really longtime goal of patching most of the mid to late 90s and early 2000s 3D games that never got any kind of unofficial patches (both known and unknown ones, seems like there's a popularity and nostalgia bias in relation to the modding community for old games), but that's proving to be way more difficult than I thought, your tutorials are helping me quite a bit though, thanks

[@jeFF0Falltrades]

So glad to hear it! So many good games in the graveyard that could potentially be resurrected! Hope you enjoy this and my other tutorials

[@jmikhailov]

Thank you for keeping the threshold of content's quality so high

[@jeFF0Falltrades]

Thank you for watching and so happy you enjoy!

[@greatnotch360]

I'm just starting to learn how to do reverse engineering, and you gave me a lot of tips where shall I find certain bits of information. Thank you!

[@jeFF0Falltrades]

So glad to hear that - thanks so much for watching and glad you enjoyed! Good luck in your learning journey.

[@govnaizmesare]

Great video! Would like to see more content like this. There's one small mistake however, the GetSystemMetrics is passed a hex value in the Ghidra overview, so instead of 20 and 21 it should be 32 and 33, which relates to the thickness of the window border and not the arrows.

[@jeFF0Falltrades]

Oh wow you are absolutely correct - I even say “They’re in decimal on this page” out loud and I still mucked that up! Thank you for pointing this out! I have added a correction in the description of the video. I really appreciate you catching this and watching!

[@sigxfs]

Awesome tutorial. I have experience reverse engineering and tweaking games with Cheat Engine but I've never taken the plunge into Ghidra as it always seemed intimidating, this video was a great introduction to it. I really appreciate you showing the x64dbg breakdown aswell, super useful.

[@jeFF0Falltrades]

So glad you enjoyed and thanks for the kind words! If you ever want to dive in deeper, feel free to check out the x86 reversing series I posted here last month.

[@nemtudom5074]

I just yesterday figured out basic hex editing to reverse engineer how Heroes of might and magic 3's scoreboard works, so this video came at just the right time to fuel my newfound interest Thanks

[@jeFF0Falltrades]

Great to hear! I’m finishing up another game modding tutorial as we speak, so stayed tuned! Thanks for watching

[@lennard21M]

I rarely watch such long videos but I enjoyed this one until the last minute. Thank you for sharing with us. Great content :) I learned a lot

[@jeFF0Falltrades]

Thank you so much for watching and for the kind words! So glad you enjoyed! I am currently at the tail end of prep for a new, very similar video - I hope you enjoy that too 😊

[@lennard21M]

@@jeFF0Falltrades Oh great, I'm looking forward to it. I'll definitely take a look. I'm new to reverse engineering and can really use videos like this :) I have a lot of fun with it

[@jeFF0Falltrades]

@@lennard21M It’s a great time (if not frustrating). So glad to hear it

[@djglitch2.031]

I was looking for a way to reverse engineer programs to understand how some functions work when building other things. I didn't know that exe decompilers already existed. Saves me a bunch of time.

[@jeFF0Falltrades]

They do and they are (or can be) wonderful. Thanks for watching!

[@djglitch2.031]

@@jeFF0Falltrades Can you make a tutorial on how to install one though? Cause it downloads a zip and I tried looking for some to no avail, unless you can add a tutorial video to the desc. that's already made. It's also very confusing on how to install programs that are in zip files in general.

[@jeFF0Falltrades]

@@djglitch2.031 You know that’s not a bad idea - I’m realizing I have it preinstalled in all my vids - Next time I make a vid with Ghidra I can do a full install of it. It’s not difficult to understand once you know how Ghidra works via Java, but yeah - I do remember I had to take a few extra steps to make a shortcut to it and such and make it “act like a normal program”. Thanks for the feedback!

[@djglitch2.031]

@@jeFF0Falltrades Np, I like the helpful programs that always seems to be in zip formats which get really annoying to work out for newbies like me.

[@padraiglogue3568]

Exceptionally high quality videos you're making here, you have a knack for teaching clearly! I'd love to see you run through some windows kernel exploits. Time to binge watch the rest of your channel

[@jeFF0Falltrades]

Thank you so much! And thanks for the recommendation - I would love to do an exploit video sometime but have to tread carefully due to YT’s rules on educational videos/malicious intent etc…have had issues in the past. But I’ll try to cobble something together sometime.

[@alexandrepereira6522]

Thanks KZbin for suggesting me this video (and of course you to have created it). One thing that I think would have helped a lot newbies like me to understand a bit more is renaming functions/variables while debugging.

[@jeFF0Falltrades]

Thanks for the great feedback! Some others have commented the same and I’d like to think I did a better job in my other videos - I was so excited to get this first one done I totally blanked on it haha. Thanks for watching!

[@BillEngwall]

What a champ Jeff, I am new to reverse engineering. Came from reddit, stayed for full hour. Loved it, understood it and it was very interactive too. Thanks a lot!! Earned a sub ;)

[@jeFF0Falltrades]

The highest praise I could get is knowing this helped someone getting started: Thank you so, so much CureofQuarantine! So glad you enjoyed, and excited to do more soon.

[@9wattcat]

Nice video! Nog den första reverse engineering videon på KZbin som har varit rolig att kolla på :)

[@jeFF0Falltrades]

Tusen tack! Det var ju målet då jag skapade kanalen, och det är så häftigt å se så många folk som njuter av ämnet. Tack för att du tittar!

[@onerimeuse]

99% assembler code, all by one dude no less. Just one guys passion project.

[@jeFF0Falltrades]

This is why I love video games - so much passion, blood, sweat, and tears poured into giving people an escape to have fun and enjoy life.

[@deathscreton]

Recently saw this on Reddit and ended up consuming the whole video during my workday. There was a time I tried my hand at creating a no-cd patch for Ancient Conquest: Quest for The Golden Fleece and hit walls. I may have to give this another shot, thanks to this vid.

[@jeFF0Falltrades]

Awesome! So glad you enjoyed and glad it inspired some tinkering! Can’t tell you how many times I walked away from a project out of frustration, only to come back and have a blast with it with fresh eyes - I hope you get some learning and fun out of it. Thanks for watching!

[@dennisanderson8663]

I remember using Dragons RCT trainer. Whoever wrote that is awesome because the number of things you could do to your rides was insane.

[@jeFF0Falltrades]

I talked about this in my latest RCT video from last week, but I am just gobsmacked by the skill of the early reversers who build tools like the OG RCT trainers with far fewer good RE tools we have today. It’s incredible.

[@nola25_]

Thank you for this educational video! I really learned a lot from it. You explained it well and kept pointing out your mistakes, which is essential for a good understanding (especially for beginners like me). I would really like to see more on patching/cracking games.

[@jeFF0Falltrades]

Thanks so much for watching and even more for the great feedback! I’ve had a LOT of requests for more game-related reversing, so that one is heavy on my mind for the next videos - I’ll try to find something creative like this but RCT was such a gem; It’s going to be hard to top.

[@MeteorMetro]

Thank you! Have been trying to get into this a few times, but have been struggling with Ghidra and couldn't find the resources until now. Great Video!

[@jeFF0Falltrades]

So glad you liked it! Thanks for watching!

[@cheez3d]

Not sure if someone already pointed this out, but at 45:35 you don't really have to use Ctrl+G in order to see what's at the addresses, because it is already shown to you above the dump views when the instruction referencing the address in question is selected in the CPU view. Example: dword ptr [rct.00C3E0A8]=20

[@jeFF0Falltrades]

Good spot - yes, I should have highlighted the little “current step” box you’re referring to, but wanted to get into the habit of using the dump view to peruse around while keeping the CPU view the same. This is a good tip, though, and I’ll try to remember to highlight that section of the GUI next time we open the debugger. Thanks for watching!

[@lugadug9475]

Thank you dude, with your help, i patched old game called "Neighbours from Hell", so now i can play without "old" fullscreen mode(800x600 window size)

[@jeFF0Falltrades]

Heck yeah! It’s always so nice to hear about people like you who go out and apply this, esp when it comes to patching old school games. Congrats, great job, and thanks for watching!

[@ХощенкоАртём]

I watched this video like a blockbuster movie! Plz, more videos like this!

[@jeFF0Falltrades]

More on the way soon! Have some ideas ready to go - just need to find the time to plan and record them :-). Thanks for watching and feel free to check out the other couple of vids here if they interest you!

[@ХощенкоАртём]

@@jeFF0Falltrades Glad to hear it) Next is 3 hour long video about solitaire)

[@waden9933]

Thank you so much! I wanted to learn more about reverse engineering this game and everything made sense. Great work with this! As an added bonus I wanted to get it running on my Steamdeck and by copying the regedit files to my system I was able to get the game running perfectly on Linux! Thanks again!

[@jeFF0Falltrades]

Oh sick!! So happy to hear that you got it working, and well done on your behalf! Thanks so much for watching and if you ever have any RE type questions, feel free to shoot me a comment/DM.

[@waden9933]

@@jeFF0Falltrades WIll do!

[@Wielorybkek]

very interesting video! I'm a programmer but I've never touched any of this low level stuff, it was really cool to learn how it works. I did not understand everything but I got the idea of what you were doing and it was satisfying to see the final solution.

[@jeFF0Falltrades]

That’s great feedback! If you’re interested in learning more of the details at a slower pace, I’d recommend checking out my x86 assembly course posted on this channel. I’ll also have another, similar video I’m hoping to publish before year end :-) Thanks for taking the time to leave a comment and so glad you enjoyed.

[@Wielorybkek]

@@jeFF0Falltrades Haha if only I had time to learn. :D But thanks for the recommendation, I appreciate the effort.

[@jeFF0Falltrades]

@@Wielorybkek So long as you’re having fun, that’s what counts 👌

[@vuurniacsquarewave5091]

I'm pretty sure giving readers some kind of a bitfield-like explanation for those values that are added up, essentially flags, would be a lot easier to digest, not to mention being able to switch value representations to binary on the fly might help... but great video! I've only ever worked with 8 and 16-bit CPUs in assembly and it's fun to see how you communicate with the OS on a modern platform.

[@jeFF0Falltrades]

Thanks for the feedback! I took both of these down for consideration in some upcoming primers for beginners - they’re both great points. Thanks for watching!

[@vuurniacsquarewave5091]

@@jeFF0Falltrades I don't think it's a you problem but rather a Microsoft documentation problem. Surely if someone is patching a disassembly there are ways to OR those property flags together and have the assembler take it from there, but it might be cleaner from Microsoft's side, to show the bitfield in addition to a 32-bit hexadecimal value.

[@username17234]

Very useful video, a valuable resource for sure, I was surprised to see it was the only video in the channel.

[@jeFF0Falltrades]

Thank you for the kind words! I’m working on a new one now, but some work and family matters (which I’ll talk about a bit in the next video), have made it prohibitive to upload often this past year. When I do put something out, I want the quality to be there :-). Thanks so much for watching.

[@gamehero7198]

this video is awsome exactly what i was looking for, i know stuff about C, C++, asm and basic workings of windows, compiling and memory, but reversing was always such an overwhelming task, im just 20 mins into the video and allready blown away on how good this is

[@jeFF0Falltrades]

So glad you enjoy! I’m working on another (very similar one) at the moment - and if you’d like to really dive in, I have an x86 assembly course posted as well. Have fun and let me know if you have any questions!

[@gamehero7198]

@@jeFF0Falltrades such a quick response :D im amazed, yeah i would definitely be interested in an asm course, i mean theres not so much good documentation on it out there (i know basic x64 asm), im only 3 years into programming as of now (or better speaking 1,5-2, 1 year i was just fooling around), wich some might consider early to dive into such, more deeper fields but i just think its so much more fascinating than just plain java script or stuff like that, that to me just seems like talking english to a computer, computer science is the way to go for me :D

[@jeFF0Falltrades]

@@gamehero7198 Haha you caught me during some downtime during travel. Awesome! Well, take it at your own pace and def don’t stress out over learning everything at once. There’s always more and more to learn later. Enjoy your studies too; I was a CS major and loved every bit of it (esp writing only a max of 2 essays in uni 😂)

[@gamehero7198]

@@jeFF0Falltrades I mean Im self taught, I spend to much time at the computer and to little at school 😅. So yeah, my goal is currently to land a job in development. I'm currently aiming at web development. Seems like web devs are always needed but my end goal is earning a living coding C or C++ mainly, but I first wanna add something to my resumee 🤷🏻‍♂️😅

[@sandrovolery1168]

Aight we've gone full circle. From a game, written in assembly, decompiled to C-code xD Nice video

[@raccdust]

Great video, very well explained and made easy to understand as a beginner of reverse engineering like myself!

[@jeFF0Falltrades]

So glad to hear!! I’m in the midst of recording a new one for beginners at RE now ;-). Stay tuned! Thank you for watching!

[@stkke93]

Evening intended to play a nostalgic game ended up with you working instead (you workaholic!) Also! for it to be too late when you were done .... classic Hat off for you.

[@jeFF0Falltrades]

Hahaha my wife still pokes fun at me because I spent much more time on the RE than I did playing (I think I played a single game the day after the upload, and then my nostalgia was fulfilled) 😆. No regrets; It was such a fun experiment. Thanks for watching!

[@TheAces1979]

Bookmarked this. You're an excellent instructor! Many thanks!

[@jeFF0Falltrades]

You are so kind, thank you! So glad you got something out of it. Hope to have a new video out shortly! So glad you enjoyed.

[@HarperLee1840]

You tutorial is fun and easy to digest! Hope there's more of it.

[@jeFF0Falltrades]

Thanks and so glad you enjoyed it! There are definitely more to come 😄

[@Block57]

26:28 Didn't see anyone comment on this yet! If you haven't figured it out by now, you can create an Enum type and assign all the values normally, and Ghidra will actually automatically show all the ORing instead of just the constant! (At least in the code view) For preexisting Windows types it may already have that defined as a Typedef, so you may want to just create a new one and substitute it out (There's a right click option now, but you can drag and drop types to replace every usage)

[@jeFF0Falltrades]

Thanks so much for this! I actually learned about this feature several months after this video was uploaded (I had just switched to Ghidra from IDA around the time I uploaded this), and I wish I had known it so much earlier. Since then, I've used it a few times for both Enums and structs (like in the latest RE video I posted) and it's so handy. I continue to learn so many nice features of Ghidra just through other people giving me these tips haha. Thanks for watching and for the great tips! I hope it's helpful to others as well.

[@JeremyKingTech]

Great stuff! Thanks for the video! I've been on a journey to learn RE for a project and your guide has been super helpful demonstrating logic/workflow to deduce functions. Cheers!

[@jeFF0Falltrades]

Thanks so much! So glad you enjoyed and happy to see you moving through that journey! Stay tuned for some more RE content coming up in Jan :-)….

[@gopro2027]

I miss game modding so much. I wanna do it for a job but not really sure where I can do that at. I just liked the puzzle part of it, it was so rewarding.

[@jeFF0Falltrades]

There are a good amount of jobs involving reversing or even game-specific reversing and mods as part of game dev/anti-cheat teams! Not to mention the malware analysis route - Hope you find something that suits you regardless! And thanks for watching!

[@subtractaddy]

Wow! Thank you so much for such a clear and approachable tutorial video! One of the hardest things with trying to learn something new and technical like reverse engineering, is feeling like you can do it. I am inspired now so thank you :D

[@jeFF0Falltrades]

So glad to hear you enjoyed, and even more happy to be part of your journey in finding out: YES! You can do it. And that goes for everyone here; believe me, if I can, you all can. Keep learning.

[@jakydibee8569]

really interesting video!!, much better dive right into the analysis than watch endless just theoretical tutorials

[@jeFF0Falltrades]

Glad to hear it! Hoping to do more when the holiday season comes around.

[@marcelyamamoto9901]

Man this was amazing, please do more! Im very intrested in start with reverse engineering too, ur video was a nice motivation! Thank you for it and the resources!

[@jeFF0Falltrades]

Not sure why I missed this when you first posted it, but thank you! I’ve got another couple of ideas planned and am going on holiday here shortly, so hoping to upload another one here soon 🤞

[@marcelyamamoto9901]

@@jeFF0FalltradesRelax man, no stress ;) Yesss, already preparing the popcorn 🥳🥳

[@Nick-lu5bn]

What a great tutorial! Thanks, I successfully patched GOG version of RCT with your help, albeit with minor complications. I don't know, maybe it's trivial matter, but I think that the following would be useful. 1:16:45 You talk about relative address without clarifying how to actually get it. Luckily, by poking around in Ghidra's Code Browser I found what I need. One can patch instruction (Ctrl+Shift+G), replacing absolute address of an old function (0x005840f8, for example) with address of a new one (0x005840a5). I can't say I understand how "CALL 0x005840a5" becomes E8 33 7A FF FF, but it still works.

[@jeFF0Falltrades]

Thanks so much for the feedback, for watching, and nice job on patching! I also realized - in working on my next video - that I did not spend enough time talking about RVAs vs offsets vs absolute addresses (this will be pivotal in the new video) so I promise I will hit on that in the next one. Regarding your question about that instruction, there are a couple of reasons I can imagine you are seeing the hex addresses you are (i.e. 0xFFFF7A33): One might be that you are seeing a relative address jump, so you are seeing a 16-bit address relative to the instruction (so all the highest bits are 0s), or it could be a placeholder value before the real address is linked. In the context of what you were doing, I think it’s probably the latter. Thanks for watching and for the great feedback!

[@santiagocalvo]

No idea how I got here but I'm subscribing, great video!!!

[@jeFF0Falltrades]

No idea either, but glad you are here!

[@bommijn]

Was fun to follow allong, thanks for the video :) Learned allot as well.

[@jeFF0Falltrades]

So glad to hear it! Thanks so much for watching!

[@santiagomanuel6843]

Thanks for the guides in the description

[@jeFF0Falltrades]

@@santiagomanuel6843 Of course! Hope you find it all helpful in your journey!

[@RichardBejtlich]

You did a great job explaining all of this. TYVM. 👏

[@jeFF0Falltrades]

@@RichardBejtlich Thank you so much for the kind words and so glad you enjoyed!

[@jeFF0Falltrades]

@@RichardBejtlich HOLD ON!

[@jeFF0Falltrades]

@@RichardBejtlich I just realized: Are you Corelight’s Richard Bejtlich?! EDIT: I’m now 99% certain you are! I just wanted to let you know that I appreciate your work, especially as believe it or not, I am a successor to your work on the CIRT at GE Aero 😂 I was going crazy wondering why your name sounded so familiar and that’s why!

[@TakadoGaming]

I'm really glad I found your channel! Looking forward to more sometime soon!

[@jeFF0Falltrades]

Me too! Thanks so much, and hope to put out more soon!

[@michaelhoefler5118]

Really really great content! I hope to see more in the future! Love the clear explanations

[@jeFF0Falltrades]

Thank you so much; I’m so glad you enjoyed. I plan to put out some more content as soon as I can - A bit busy with a new kid on the way for now, but I have some ideas that are staged for some future videos :-)

[@skullsNscalps]

My knowledge didn't go beyond "Mitochondria is the power house of the cell."

[@Tehploe]

This was a lot of fun! Great video.

[@jeFF0Falltrades]

So glad you enjoyed! Thanks so much for watching and for the kind words!

[@XxXjujio2013XxX]

Thanks for the video. I... just... one day I gonna see it, but not today.

[@jeFF0Falltrades]

Take your time...I’ll be here ¯\_(ツ)_/¯ 😁

[@Ataraxia_Atom]

This is freaking awesome! I loved this game

[@jeFF0Falltrades]

It really does so much for the nostalgic soul - Thanks so much for watching!

[@valhalla_dev]

Fantastic content buddy, I learned a ton about the mentality/methodology as well as the practical manner that patches are applied.

[@jeFF0Falltrades]

Appreciate you watching it through man - thanks for the kind words and hope you enjoyed it.

[@erickuhn3500]

Well done! I enjoyed watching this video a lot.

[@jeFF0Falltrades]

Thank you so much and glad to hear! If you haven’t seen the spiritual successor to this one (the latest RCT vid on the channel), you’d likely enjoy that one as well - much stranger but more interesting 😂 Thanks so much for watching and glad you enjoyed!

[@tetraphobie]

I was looking for an introductory Ghidra tutorial and came across your video. Really like how you explain your thought process making the whole process very easy to follow and understand. I'd certainly recommend this video to any C/C++/assembly programmer interested in reverse engineering as an accessible entry point. Saw that Ghidra has a debugger now. I wonder how good it is compared to x64dbg. :)

[@jeFF0Falltrades]

So glad you enjoyed! I really appreciate the feedback. I have another video idea I am working on right now that I hope to improve in terms of a “reversing beginner’s tutorial” based on lessons learned from publishing this video. And FWIW, I still enjoy using x64dbg for now; But probably just because I know where everything is :-)

[@tetraphobie]

​@@jeFF0Falltrades That's very cool! I'll likely give it a watch when it's out. Best of luck with your work! :)

[@tetraphobie]

Small update: inspired by your video I tried doing some reverse engineering of an old MS-DOS app with Ghidra. But it turns out Ghidra has incomplete support for 16-bit real mode and gets confused by segment registers and far pointers. Either that or I'm missing something. Oh well. 😂

[@bigapple89]

Great video. I wish you showed a bit more of the gameplay in its new fullscreen glory

[@jeFF0Falltrades]

My wife loves to poke fun at me because I barely got a chance to play following this (I did play for a good few days though) - I was too excited about this whole exploration that I was so much more focused on getting the video out. So glad you enjoyed!

[@eitantal726]

This video makes me miss my University days...

[@l3lackoutsMedia]

This is the first reverse engineering ghidra video, that seems to click instantly for me.

[@jeFF0Falltrades]

Glad to hear it!! Thanks for watching and hope to have a new video out soon.

[@OthmanAlikhan]

Thanks for taking the effort in making a rather lengthy and quality video. I've learned quite a few things from watching =)

[@jeFF0Falltrades]

Thank you so much for watching and for the kind words. I really tried to make this as accessible as possible - I’m glad to hear it was helpful!

[@sanderbos4243]

Amazing tutorial, I'm sure I'll be rewatching it again fully in the future! :)

[@jeFF0Falltrades]

Thanks so much - so glad you enjoyed it and hope you continue to get something out of it. Something new coming to the channel this week, too ;-)

[@JellyLancelot]

Truly an awesome video, so interesting and such an engaging topic.

[@jeFF0Falltrades]

So glad you enjoyed! Hope you continue to enjoy the channel, and thanks so much for watching

[@Pi7on]

Very informative, thanks for documenting the whole process!

[@jeFF0Falltrades]

Thanks for watching and so glad you got something out of it! More coming soon :-)

[@Pi7on]

@@jeFF0Falltrades glad to hear it! I'm definitely keeping an eye out for your vids! Personally I love watching people reverse engineering a game to fix an abscure bug. Do you know mattkc and exilelord? They made a video on lego island and guitar hero respectively, documenting their journey reversing the game. I love this stuff

[@callfordoody6793]

When is the next video coming out? Im terrible at reversing games and game engines so Im excited to see how you do it.

[@jeFF0Falltrades]

I’m hoping to record it in the upcoming week! Just wrapped up writing for it over the last couple of weeks :-). I hope you enjoy it…it will be very similar to this one

[@ByronHadley1]

Five star stuff. Thanks so much for sharing. Easy to follow and extremely educational!

[@jeFF0Falltrades]

Thank you so much, Byron! So glad to hear you thought so. Looking forward to making more once I finish a couple of projects :-)

[@The_Makers_Prerogative]

I enjoyed following your workflow, Excellent Video!

[@jeFF0Falltrades]

So glad you enjoyed! Thanks for watching!

[@ferna2294]

Beautiful. This will be very useful. Thank you so much!

[@jeFF0Falltrades]

I hope so! Thanks so much for watching!

[@matthewbascom]

Thank you for sharing all this work. A nice complement to this video would be your design process for the patch python script. Also, how did you design the two key-value pairs within the PATCHES dictionary? Is there a way to record zoomed in on the screen where you're performing edits? It would be nice if the focus of your work was much bigger to make it easier for the audience to read & watch.

[@taguetrash]

34:50 You searched for "20" instead of 32 (0x20) - the proper result would be SM_CXSIZEFRAME, the thickness of the border around the window, not scrollbars. Awesome tutorial btw!

[@jeFF0Falltrades]

Thank you! Yes - other folks pointed this out too and I can’t believe I missed it during recording because I *literally* said something along the lines of “and here are the values in hex” Thanks for watching!

[@taguetrash]

@@jeFF0Falltrades My bad, i didn't see those comments until after I wrote mine! And thank you very much for making the video!

[@jeFF0Falltrades]

@@taguetrash Hey not at all! I don’t expect you to read every one, but I do try to put corrections in the description (in this first video) or my pinned comment (all other videos)

[@DrixoGaming]

Well just saying it's was realy good to watch even i don't have any tips to give but i was wanted to say how i appreciat the flow and everything it was interresing.

[@jeFF0Falltrades]

Thank you so much, Dj-Xo! I’m so happy you enjoyed.

[@timfennis91]

Thanks for making this video. I've always been curious about reverse engineering and this was definitely a very good introduction. If I had to offer any criticism I would agree with some others that naming the variables would have been great, and for me personally the tempo could have been higher. You obviously worried a lot that this video would be too difficult for your audience but I think it's fine.

[@jeFF0Falltrades]

Thank you for the feedback! Some others mentioned the same, and I agree - I’ve gotten better at this with my more recent videos (I think I was just too excited when filming this first one that it just fell right out of my head to label everything). Thanks for watching!

[@blagoevski336]

I fell asleep not knowing that that i didn't turn off my phone and slept through this entire video.

[@JT-xu1qd]

It's easy to see why this game was so great, it was stacked with FUN_

[@jeFF0Falltrades]

Did we just become best (nerd) friends???

[@m3taldragon1]

Bruh... I'm colorblind and I never knew it. 53:30 just blew my mind.

[@jeFF0Falltrades]

I am glad you found out man! I believe you can change those colors in preference, but I’m not 100% sure - I don’t have my laptop with me ATM but I’ll try to remember to follow up with you after I can check.

[@PolymorphicPinapple]

incredible video and thank you for sharing! a question though: i might have missed it but what was the reason that the in-game options for different resolutions not work? if i understood correctly, these patches will not address those issues?

[@jeFF0Falltrades]

You did not miss it! In fact, I did a follow-up on this very section in my latest video (Part 2 of “Modding RCT into a Peele Horror Film). More details there, but TL;DR: I never figured out the exact mechanism that was causing the failure, but it appears to be related to DirectX’s compatibility with newer Windows versions - The game tries to repaint at a higher resolution, but gets overridden by DirectX at a lower resolution, causing the window to only get partially painted, and creating those black boxes you saw in the intro. The DirectX method of rendering is inly used in full screen modes, so the patch essentially makes a “borderless” windowed mode to get around this. Thanks so much for watching and for the kind words!

[@wmyttmlimvty]

Fun fact: Exactly this 0:56 happened to my browser for no reason (I'm not kidding) while I was watching this video and I had to re-open it (luckly just happened one time :b)

[@wmyttmlimvty]

I was like ayo wtf

[@V_ice]

these videos are a god send

[@jeFF0Falltrades]

So glad you enjoy them!

[@Antonio-yy2ec]

This video is pure gold

[@jeFF0Falltrades]

Your comment is pure gold, my dude. Thanks for watching and glad you enjoyed

[@TheWayManREAL]

this actually is a good tutorial not one of those 5 min vids that doesn't go in-depth on anything

[@jeFF0Falltrades]

Thank you! So happy to hear it was helpful. I’ve got another couple planned and am going on holiday here shortly, so hoping to upload another one here soon 🤞

[@TheWayManREAL]

@@jeFF0Falltrades I think doing a game like that was a perfect example because most people who do this are looking at games and messing around with old games like RCT

[@akaez2807]

Great job Excellent explanatory

[@jeFF0Falltrades]

Thank you so much - and thanks for watching!

[@HikikomoriDev]

Ghidra is kinda cool, it looks classy, like some Win2000 or NT 4 application.

[@mohssineelharfi5909]

sure thing, I enjoyed it a lot, thx for this awsome content

[@AutarchKade]

1:21 I wonder how many people caught that subtle change there, I laughed out loud.

[@jeFF0Falltrades]

As long as you did, I can die happy

[@omdangy]

Brilliant tutorial! You're a very good teacher, thank you

[@jeFF0Falltrades]

Thank you so much for your kind words - I hope it was helpful to you!

[@OrIoN1989]

Great video. I am partially on the other side trying to figure out how to make the code less hackable. But I understand its also a two edged sword if you want to make a fix 20 years down the road.

[@jeFF0Falltrades]

Nice! Yes, it’s always a balancing act, and more and more difficult to obfuscate away code, but there are several techniques employed today to do so by both smaller and larger studios. Thanks for the kind words and for watching!

[@game2playz685]

Hey, great video, however I am a bit stuck at the moment. Im trying to reverse engineer the save format for a game I am currently playing, however the x32dbg addresses dont seem to match up with my ghidra addresses. Is it possible for a 32bit .exe to still use ASLR?

[@game2playz685]

For example the address when the Filestream is initalized is shown in Ghidra to be "00401bd9", but in x32dbg its "6C14A580"

[@jeFF0Falltrades]

The address shown in Ghidra is just a preferred base address - in fact, your operating system can load that EXE at any memory address it wants for any variety of reasons. To adjust for this, you can tell Ghidra to remap the memory addresses it shows by going to Window->Memory Map->Set Image Base (the house button).

[@game2playz685]

@@jeFF0Falltrades Ah okay I see, thank you! So why did yours match up without changing the Image Base? Did I miss the part, where you changed that?

[@jeFF0Falltrades]

​@@game2playz685 Nope - I did not change it; It may be you're seeing differently since ASLR is set to be used somewhere in your operating system, and so the loader will always randomize the memory address (disclaimer: not necessarily between runs in a short period of time) of the PE.

[@kinggalactix]

This is a pretty interesting video so far. Right now, I'm trying to learn how to decrypt and XEX file (Xbox Executable). And thus far, I'm kinda struggling on finding anything useful. All I see are lots of random functions and such, and barely any code. But this guide is a pretty good basis for me getting started.

[@jeFF0Falltrades]

Good stuff! I know XEX is a bit more of its own beast, but feel free to check out my other RE videos here if you need help with other basic concepts behind reversing.

[@kinggalactix]

@@jeFF0Falltrades I'll certainly take a look! from what I know about my XEX, it's going to take way longer than 2 months to fix a bunch of stuff. But at the moment, I'm just looking to find certain sections of code.

[@kinggalactix]

I do believe as I play through the game, more of the code will inevitably unlock.

[@jeFF0Falltrades]

@@kinggalactix Good luck! And thanks for watching!

[@kinggalactix]

@@jeFF0Falltrades No, thank you for the guide! Good luck to you, too.

[@TeamUnpro]

Fantastic tutorial, hope you dont suffer from burnout issues like I do lol, the vids 2 years old so I suppose you're still kicking, so keep at it :) Subbed

[@jeFF0Falltrades]

Nope! In fact, just about to record a very similar video this week! Still loving doing this channel, as opposed to my last one which did very much become a burnout. Thanks so much for the sub and for watching!

[@TeamUnpro]

Looking forward to the vid!@@jeFF0Falltrades

[@_________________404]

You could make a simple gui for the python program and then somehow append the compiled exe to the game's executable and modify the main function so it starts the "patch" program first and allows the user to choose full screen or window mode on each launch, right? Assuming that the python exe is fully statically linked and doesn't depend on some dynamic libs which aren't loaded in the context of the game.

[@jeFF0Falltrades]

@@_________________404 Would likely be easier to make a GUI for the Python script, package it into a static executable, and then just make the user point to their instance of RCT to do the patching appropriately; You might be able to package them both together in one EXE, but it would get messy with addressing and modifying the original executable.

[@MrDennisloi]

This is super useful, thank you so much! I haven't understood one thing, why the original is glitchy while setting fullscreen while the patch works flawless? Isn't the same function called when setting fullscreen in-game? Maybe is explained in the video and i've missed it

[@jeFF0Falltrades]

Great question! I regret I didn’t answer this in the video here…but without saying too much, stay tuned because I’ll try to answer that question in an upcoming video which will revisit some of this 😉

[@MrDennisloi]

@@jeFF0Falltrades Awesome! Thank you

[@galihriskipratama3631]

my 1 bit brain can't process what is happening, but I enjoy it

[@jeFF0Falltrades]

Congratulations - You have the spirit of a seasoned reverser! 😂

[@omerbennahum1903]

Beautiful demo. Thanks!

[@jeFF0Falltrades]

Glad you enjoyed! Hope to do more soon!

[@mouradelectronics5180]

Hello, how are you? If so, I want help from you in the crack program. Thank you