11 ms·
Bringing a decade old vector editor back to life
- bjonnh 6y agoThis was an entertaining read and well explained.
- aardvark291 6y agoWhat program do those disassembly screenshots come from?
- WrtCdEvrydy 6y agoReplying just in case you get an answer, those are cool.
- blcArmadillo 6y agoI think it's from IDA. For example see screenshots here: https://www.hex-rays.com/products/ida/6_0/ https://www.hex-rays.com/products/ida/6_0/. There are similar reverse engineering tools that are open source such as: - Ghidra: https://ghidra-sre.org/ https://ghidra-sre.org/ - radare2: https://rada.re/n/radare2.html https://rada.re/n/radare2.html
- 2StepsOutOfLine 6y agoFrom the author: "the x86 disassembly comes from IDA, the VM disassembly is literally in notepad++ and generated by my disassembler"
- chocolatkey 6y agoThat was really cool and educational, especially the part about reverse engineering the VM! Makes me wonder if all companies go to such trouble to protect their IP, especially since it seems that VM was in-house
- Multicomp 6y agoThis was amazing to read. Reading stories of reverse engineering and cracking long-dead programs are interesting enough, but then being able to buy the domain and re-implement the authentication servers from just what the client expects?! I'm staggered at the skills needed to do that.
- matheusmoreira 6y agoIt's amazing what people can accomplish... Gives me hope that old video games will one day receive the same treatment. Way too many of them lost online multiplayer after the game company moved on.
- marcan_42 6y agoUnfortunately, this is only possible because the obfuscation used is just weak obfuscation. Once you throw real public-key encryption into the game, which is what any competent company trying to avoid cloned servers should be doing, there is no way to create alternate servers just from game data. You need to at the very least patch the game and change the key.
- deleted 6y ago[deleted]
- quietbritishjim 6y agoI'm not sure the parent comment is necessarily going for a patchless solution, and as you say, by the time you have got far enough with reverse engineering for the particular type of encryption to matter, you can always just patch the executable to bypass it altogether. (In fact by halfway down the article the author had done exactly that.) Besides, I'm not even convinced that "any competent company" would bother with public/private key cryptography given that it makes little difference to them how exactly their copy protection is broken. The bigger problem for the parent commenter is if actual game logic is executing on the server, which is probably the case for online multiplayer games.
- jonathanlydall 6y agoBlizzard (I suspect) did exactly this with the original Warcraft III. To play on an emulated Battle.net server you had to apply a patch to the client .exe or it would refuse to connect. I remember chatting with one of the emulator developers on IRC and they said it was practically impossible to reverse engineer the key, so that sounded to me like public/private key encryption. I suspect Blizzard reasoned that it made the emulated servers less legitimate and that people uncomfortable downloading "cracks" would be put off. It didn't have to be fool proof, just raise the bar high enough to encourage more sales.
- userbinator 6y agoThis is part of a larger pattern of fairly weak attempts to confuse a reverse engineer that made it frustrating to figure out what all the opcodes did, and there were many duplicate opcodes that were just implemented in different ways. Since the code presented in the article didn't look like handwritten Asm (and if it was, it would've probably been even more insanely obfuscated and greatly confused IDA's decompilation), I wonder if compilers of the time were far worse at optimisation, or if the author deliberately disabled it so that the code would be more bloated and harder to understand as well as containing the source obfuscations; seems like "Here's addition implemented by multiplying the result with some number and its reciprocal" would be something that's replaced-on-sight by an optimiser doing constant propagation. Also, I was not surprised to discover that this program appears to be both [1] of German origin, and [2] shareware. When I was in the cracking scene long ago, "German shareware" was widely known for the insane strength of its protection.
- russdill 6y agoA lot of obfuscators out there use VMs with convoluted pieces of assembly implementing each opcode of the VM. Pushing, popping, swapping register values, etc, etc. In many cases the opcodes are microinstructions that can be used to implement x86 instructions making the VM an x86 emulator. It's super satisfying when you finally get x86 opcodes out of the other end and then patch those back into the program.
- atombender 6y agoPure speculation, but it's quite possible that it was written in Delphi (the last iteration of Borland's Turbo Pascal lineage), which had a fast single-pass compiler that did very little optimization. Delphi was very popular in Germany in the late 1990s and early 2000s.
- imtringued 6y agoDelphi makes things worse because the code it generates is incredibly ugly. The code listings use the C++ std and it looks straightforward so presumably it is just good old C++.
- megiddo 6y agoWhat a magnificent yak shave.
- tambourine_man 6y agoI though it was FreeHand. Maybe someday
- libria 6y agoOh that brings me way back. Got my start in dev idly editing websites in Macromedia Homesite and Freehand and Firesomething. I figured Adobe already killed off the MM stuff.
- wlesieutre 6y agoMacromedia Fireworks, I liked that one!
- Lorin 6y agoI still use the final version Adobe released - it's a damn shame as it is the perfect mix of pixel and vector for quick day to day editing and web layout design.
- hnzix 6y agoFreehand, Fireworks and Director all great Macromedia programs killed by M'Adobe. RIP.
- themodelplumber 6y agoIt was brilliant. I blame the emergence of flat design on the death of Fireworks ;-)
- purerandomness 6y agoI hoped to hear someone finally ported Xara LX [1] to Cairo... [1] https://en.wikipedia.org/wiki/Xara_Xtreme_LX https://en.wikipedia.org/wiki/Xara_Xtreme_LX
- teleforce 6y agoLooking forward for this as well. I've used Xara Extreme version 4 (released around 2008) couple of years after they have released Xara Extreme LX, and I've still got the CD with me. It's probably the fastest and the most intuitive graphics editor I've used. It seamlessly managed to integrate raster and vector graphics editing for the masses.
- Jasper_ 6y agoI've reverse engineered a number of content encryption schemes. It's always a ton of fun, and you get to see the large amount of psychological warfare at play at the higher tiers. A very common trick that I've seen in a lot of Japanese games, for offline material, is to combine a hashing system and encryption. That is, the game will attempt to load "main.script", which is a custom bytecode scripting language. The file stored on disk would have the filename of a SHA1 hash of "main.script", but the contents would be encrypted with a private key like "tprics.niam". "main.script" then loads a number of other files using its scripting system, so it's a very annoying process to take the whole thing apart, as you need to hunt down the original filename through the scripting system. Either that or you guess at filenames. You tend to see some really high-level effort put into systems, like the one game I took apart that had its own custom scripting language with classes and coroutines. https://gist.github.com/magcius/bff948b13128b70695e3841e208407ce https://gist.github.com/magcius/bff948b13128b70695e3841e2084... One game I found had a custom bytecode system that drove me nuts for weeks. The opcodes were specifically picked so that a large number of the popular ones were reflections of each other in dec, hex and binary. So you'd go "I've seen opcode 0x0353 before", but alas, you had actually seen opcode decimal 353. Similarly, there were opcodes 101 and 0x101 and 0b101 and they all did slightly different things. You think you could stick to hex, but there's enough slop in the process and your brain is so used to pattern-matching that it was pretty effective.
- userbinator 6y agoIndeed, it's often more fun than playing the game itself; but then again, I'm someone who has been taking things apart since I was very young (and not surprisingly, got into trouble a few times for it...) I suspect RE is something that's closer to what those in the other sciences do, i.e. analysis and thinking more about how/why things are the way they are, rather than what they can build; which is why not a lot of developers (who almost always build, except when they have to debug) seem to have any interest/skills of RE much if at all.
- geitir 6y agoThat comparison was really insightful to me
- gayprogrammer 6y agoWhat is the backstory behind why the company stopped selling this software? Has anyone asked the author or company about it? Would it be worth asking them to release the source since it's been so long since selling it?
- 2StepsOutOfLine 6y agoWollay and most software development he does is intermittent at best. The Cube World community went 6 years without an update. He will occasionally (every few years) post screenshots and teasers on social media, but it seems very clear that development of his projects is whimsical. I don't think anyone at this point would be surprised if he tweeted out tomorrow that he's done developing Cube World. It also seems that Plasma was never actually sold. It was a preview that just required a free signup.
- jandrese 6y agoAt this point he can't bring it back. The article author bought the expired domain and put up his own authentication server on it.
- maeln 6y agoIn the case of Cube World, he finally decided to come out of the wood and release the game on steam. Almost none of the feature he teased during those years were included in the release or were heavily changed, and even the core gameplay was very different than the beta, which made a lot of people angry. He wrote an article explaining that the DDOS they suffered when first releasing Cube World had a lot of impact on his mental health and that is why he rarely communicated and then he disappeared again.
- Jerry2 6y agoWhoa, this editor was quite amazing! If you have two minutes, watch the "Photo Texturing" and "Photo Editing" demonstrations: https://youtu.be/bCWX3BNT1H0?t=150 https://youtu.be/bCWX3BNT1H0?t=150
- zimpenfish 6y agoI guess you could emulate the "Photo Texturing" functionality in something like Blender with UV Unwrapping? Will give it a go later. The "Image Warping" I'm pretty sure you can do in Photoshop these days tho'.
- rangibaby 6y ago> I guess you could emulate the "Photo Texturing" functionality in something like Blender with UV Unwrapping? Will give it a go later. Yes, you can do exactly that. To me the app looks like a happy medium between 2D and 3D art software.
- rcxdude 6y agoI've achieved a similar effect with Krita's warp tool and 'transform layers' (which let you treat a transformation as a filter layer so you can still edit the un-transformed version), but it's clearly not a use-case the developers intended and therefore is nowhere near as smooth to use.
- mkl 6y agoMore here: https://www.youtube.com/user/Picroma/videos https://www.youtube.com/user/Picroma/videos It's really impressive! It's based on some kind of subdivision primitive I've never seen used like this before.
- pjmlp 6y agoUau! Congratulations, that was lots of effort going through all of that.
- Benjamin_Dobell 6y agoThis is really cool, and certainly a solid example of why the legislation is moronic. However, isn't this a violation of DMCA's (and similar legislation worldwide) "software lock" circumvention laws? > It's not pretty, but this is probably the first time anyone's been able to use Plasma at all in the better part of a decade. It seems that Wollay removed a critical UI file (for the sheet which artwork exists on) from Plasma, and made it so that the server would provide an obfuscated version of it to the client. That way, no amount of tampering could get an unauthorized copy of Plasma to work. Unfortunately, without the authentication server, authorized copies of Plasma cannot work anyway. Around this time, I started looking at what the picroma.de domain used to point to. I didn't find much of interest on archive.org, but... The domain was now available after all these years, and I bought it. To clarify, none of the reverse engineering stuff is the issue. However, when your start reimplementing or circumventing "authorization", then you're potentially in some trouble. Worse, it's not civil, like copyright infringement, whereby the IP owner has to go after you. It's criminal, so technically law enforcement themselves can go after you. In this case it seems unlikely, still though, be careful, folks.
- CobrastanJorji 6y ago(caveat: IANAL and am frequently wrong) The DMCA provides a singularly annoying exemption process. Every three years, the Librarian of Congress makes a determination of valid exemptions to the DMCA. These exemptions are complicated to apply for, and having been previously granted theoretically has no impact on whether it is granted the next time, so anyone who wants to maintain an exemption needs to reapply and make their case every three years. From 2018 and until 2021, there are 14 DMCA exemptions in effect. One of them is "Computer programs, except videos games, no longer reasonably available in commercial marketplace, for preservation by eligible libraries, archives, and museums." Unfortunately, while this software is not a video game, nor is it reasonably available, it is not covered by this clause, as "the work cannot be made available or distributed outside the physical premises of the eligible institution." Not to worry, though! There is one other possible exemption. Number 11: "Computer programs, for purposes of good-faith security research." Is this good-faith security research? Well, one of the tests there is whether the "information is used primarily to promote security of devices on which the program operates." This probably does the opposite, being an effective argument and tutorial AGAINST security, so it probably doesn't work, either. So yes, this is probably illegal. It could maybe even be a felony, technically. You could probably get years in prison for it. You wouldn't, but that won't stop a fed from convincing you of that in order to get you to sign a confession.
- gadders 6y agoSomething that just occurred to me - that encryption routine looked like a lot of work. Do you think the creator would have been net up in revenue terms to add features, or using this feature to reduce piracy?
- pram 6y agoIt’s insane to me that such a full featured graphics editor was just abandoned.
- vanderZwan 6y agoMy guess is that when CubeWorld went viral it sucked up all of the time of the sole developer.
- nwsm 6y agoNice work! Coincidentally I saw the product of your work first on the CubeWorld subreddit. You didn't lead on as to how much reverse engineering was required.
- ellis0n 6y agoGood job! QA: Are you still need that again with your developer tools?