3 ms·
For games, I find that it is much easier to dynamically anaylze them while they are running to get an idea where you should be looking. Use something like cheat
by doix 5y ago
For games, I find that it is much easier to dynamically anaylze them while they are running to get an idea where you should be looking. Use something like cheat engine to get the address of health and use the built in debugger to find what writes to that health address. Then you can get the address for the instructions that write to the health and go back to something like Ghidra and start reverse engineering from there. But for small indie games, the dissasmbler in Cheat Engine is actually quite good depending on what you are trying to do.
An understanding of how C/C++ memory mangement works and how things like arrays/pointers etc normally get compiled down by the compiler. Having a general idea of how indie games a typically made (a loop which reads input -> updates game state -> draws to the screne) helps as well. In the case of finding what writes to the HP, you'll end up in a function that most likely updates game state, so you can then just walk up the functions to get to the main loop.
I spent a lot of my youth reverse engineering a small indie game. It go to the point where as a community we reverse engineered most of the in game objects into C header files. Then with the help of those header files, we made custom AI possible. Used a DLL to detour the normal AI function to our function and in that function we loaded Angelscript files that had access to the original game objects so they could control the objects. Ghidra didn't exist back then, and IDA was too expensive and the Cheat Engine dissambler was bad, so we reverse engineered everything in Ollydbg.
This was of course for a tiny indie game with a custom engine. I imagine now days with everything being made in Unity/Unreal etc, it's much harder to reverse engineer. Also x86 calling conventions were nicer than x64 imo ;).
- Faark 5y ago> I imagine now days with everything being made in Unity/Unreal etc, it's much harder to reverse engineer. Unity games are actually incredibly pleasant to reverse engineer most of the time, since they are built on .NET/Mono. Unless they are intentionally obfuscated (don't think I had that more than once) you can pretty much just drag and drop the Data\Managed\Assembly-CSharp.dll into your .NET decompiler of choice. The byte code is pretty close to source, with pretty much the entire class structures still there. Only the inside of functions has to be restored, thus the AST might be slightly different and variable names gone. Even more comfortable are pure .NET games... simply attached the full IDE to debug. Rider even takes care of the decompilation on the fly.
- doix 5y agoInteresting, I was unaware that Unity was all .NET, thanks for the info! I have messed about with Terraria reverse engineering (pure .NET) and that was easy like you said.