I started reverse engineering a game about 3 months ago with no prior experience. It is insanely difficult. I like to think that I have very good pattern recognition and investigative skills, I find most problems surmountable given enough time. But I'm barely making any progress and am tearing my hair out just to find tiny breadcrumbs of clues. Maybe this is one of those things where picking up a few books is imperat…
Analysis of large binaries and games in Ghidra-SRE
11–20 of 25 posts
Re: Analysis of large binaries and games in Ghidra-SRE
#12I started reverse engineering a game about 3 months ago with no prior experience. It is insanely difficult. I like to think that I have very good pattern recognition and investigative skills, I find most problems surmountable given enough time. But I'm barely making any progress and am tearing my hair out just to find tiny breadcrumbs of clues. Maybe this is one of those things where picking up a few books is imperat…
I did this with a Tetris clone, then a Minesweeper clone and then I did a multi-threaded "Shoot the ducks" clone, each duck being a thread. Probably will take you several months but at the end you'll really be able to do a lot of RE.
Re: Analysis of large binaries and games in Ghidra-SRE
#13I started reverse engineering a game about 3 months ago with no prior experience. It is insanely difficult. I like to think that I have very good pattern recognition and investigative skills, I find most problems surmountable given enough time. But I'm barely making any progress and am tearing my hair out just to find tiny breadcrumbs of clues. Maybe this is one of those things where picking up a few books is imperat…
Re: Analysis of large binaries and games in Ghidra-SRE
#14Ghidra is really neat, so a couple times I've tried to do reversing of small games through it to practice. Turns out stuff is really hard, despite Ghidra doing a bunch of work to try and get things to be super easy. Even for really small old indie windows games I think you really have to have a good idea of what kind of tools the people are using to get places. That or get really lucky in a string search :)
It's more like you need to have cut your teeth before on SW development and RE since you need a good gut feeling of what bundle of assembly lines/C code correspond to what kind of functionality the developer had in mind. Trying to RE production SW without any prior development experience is brutally hard.
I remember this back when people wanted to learn cracks/keygens: If it was anything more than replacing a value with a hex editor, it was too complicated.
Re: Analysis of large binaries and games in Ghidra-SRE
#15Re: Analysis of large binaries and games in Ghidra-SRE
#16Ghidra is really neat, so a couple times I've tried to do reversing of small games through it to practice. Turns out stuff is really hard, despite Ghidra doing a bunch of work to try and get things to be super easy. Even for really small old indie windows games I think you really have to have a good idea of what kind of tools the people are using to get places. That or get really lucky in a string search :)
An understanding of how C/C++ memory mangement works and how things like arrays/pointers etc normally get compiled down by the compiler. Having a general idea of how indie games a typically made (a loop which reads input -> updates game state -> draws to the screne) helps as well. In the case of finding what writes to the HP, you'll end up in a function that most likely updates game state, so you can then just walk up the functions to get to the main loop.
I spent a lot of my youth reverse engineering a small indie game. It go to the point where as a community we reverse engineered most of the in game objects into C header files. Then with the help of those header files, we made custom AI possible. Used a DLL to detour the normal AI function to our function and in that function we loaded Angelscript files that had access to the original game objects so they could control the objects. Ghidra didn't exist back then, and IDA was too expensive and the Cheat Engine dissambler was bad, so we reverse engineered everything in Ollydbg.
This was of course for a tiny indie game with a custom engine. I imagine now days with everything being made in Unity/Unreal etc, it's much harder to reverse engineer. Also x86 calling conventions were nicer than x64 imo ;).
Re: Analysis of large binaries and games in Ghidra-SRE
#17And there is a dub patch to apply the Japanese audio to it too, or was.
Now to find a copy...
Re: Analysis of large binaries and games in Ghidra-SRE
#18I recently started analysing a game with Ghidra. I found the plugin mentioned was actually fairly useless in my case (but this was version 9, maybe things have changed), instead I used OOAnalyzer [1] and its associated Ghidra plugin - great for bootstrapping a class hierarchy, which is otherwise extremely tedious to do. It took 24 hours and ~100GB of memory, so I ran it on AWS, splitting the analysis in parts accordi…
I've also had significantly more success with OOAnalyzer but as you say, it's dog slow and just consumes an unfathomable amount of memory. I had a few binaries it just completely choked on regardless of part size.
Finally, while Ghidra is pretty cool in theory, in practice it's quite brittle and rough at the edges. I've had projects get corrupted, analysis that always hang indefinitely with no diagnostic information why. And it performs about the same on a 4-core host as a 64-core host, which deeply saddens me, as almost nothing is multithreaded.
Re: Analysis of large binaries and games in Ghidra-SRE
#19I recently started analysing a game with Ghidra. I found the plugin mentioned was actually fairly useless in my case (but this was version 9, maybe things have changed), instead I used OOAnalyzer [1] and its associated Ghidra plugin - great for bootstrapping a class hierarchy, which is otherwise extremely tedious to do. It took 24 hours and ~100GB of memory, so I ran it on AWS, splitting the analysis in parts accordi…
I've also found Ghidra nearly useless for most things. IDA seems to blow it out of the water. I've also had significantly more success with OOAnalyzer but as you say, it's dog slow and just consumes an unfathomable amount of memory. I had a few binaries it just completely choked on regardless of part size. Finally, while Ghidra is pretty cool in theory, in practice it's quite brittle and rough at the edges. I've had…
Re: Analysis of large binaries and games in Ghidra-SRE
#20Ghidra is really neat, so a couple times I've tried to do reversing of small games through it to practice. Turns out stuff is really hard, despite Ghidra doing a bunch of work to try and get things to be super easy. Even for really small old indie windows games I think you really have to have a good idea of what kind of tools the people are using to get places. That or get really lucky in a string search :)
It's more like you need to have cut your teeth before on SW development and RE since you need a good gut feeling of what bundle of assembly lines/C code correspond to what kind of functionality the developer had in mind. Trying to RE production SW without any prior development experience is brutally hard.
I am trying to RE a 16bit windows game. Ghidra gets lost a lot on the exe to system dll paths for me. For 32bit it seems fine though.