24 ms·
Using Ghidra and Python to reverse engineer Ecco the Dolphin
- skibz 2y agoI'd love to see footage of the underwater soccer cheat in action.
- trlaknb 2y ago[flagged]
- bobajeff 2y ago>Python is indeed good for small throwaway scripts I think you just answered your own question.
- batch12 2y agoMaybe the author is more comfortable with Python than the alternatives.
- exe34 2y agopython is great for a lot more than small throwaway scripts.
- ok123456 2y agoDepends on who you ask and to what lengths you're willing to go.
- exe34 2y ago"Python is used by Intel, IBM, NASA, Pixar, Netflix, Facebook, JP Morgan Chase, Spotify, and a number of other massive companies. It's one of the four main languages at Google, while Google's YouTube is largely written in Python. Same with Reddit, Pinterest, and Instagram" "Python is used heavily in academic research, particularly in bioinformatics, biology, and mathematics. It is the standard introductory language for many university computer science programs." https://brainstation.io/career-guides/who-uses-python-today https://brainstation.io/career-guides/who-uses-python-today Misquotation alert: I'm not claiming python is perfect for everything. There are times it makes sense to use something else. Not-short-scripts isn't it.
- Brian_K_White 2y agoIt's utter garbage outside of a controlled environment. Youtube can use it because Youtube will have an official environment and there will be no such thing as a script that was written in one version or with one module installed that then breaks at run time. The impressive size of the big users actually works against proving how great it is. Use the official version inside Google or Netflix: ok. Use in a package where the package manager ensures all dependencies and versions are met exactly: ok Use by writing and immediately using and discarding today: ok Write a random script and expect it to work in 6 months or on any other machine or god forbid another platform: forget it. python is great for the author and miserable for everyone else
- exe34 2y agoI assume the last time you used python was during the transition from 2 to 3? I haven't had any problems with versions over the last 5 years. conda is a really good way of ensuring you get the same environment if you need to freeze versions.
- ok123456 2y agoconda is a non-standard python tooling with canned environments with packages that are years out of date, a constraint solver in its package manager that randomly seems to run forever, and it's a commercial product. Of all the Python packaging solutions, it's the worst. The fact that so many people use it, as a matter of course, is further evidence of the fragility and complexity of maintaining Python tooling and codebases in general. The fragility of Python packaging is how we arrived at the current status quo of needing a CD/CI setup for hello-world.py. My statically-linked Fortran executables? I could keep copying around the same binaries until people switched architecture.
- exe34 2y agohello-world.py works out of the box!
- 2y ago
- bt1a 2y agoWhat is the importance of needing to frame Python as tiny here? The reminder that programming languages are acceptable for small throwaway scripts is appreciated
- vips7L 2y agoI believe they were calling the function tiny, which it is, it’s 27 lines.
- zahlman 2y agoGhidra is an already existing piece of software; the Python script was written for the specific purpose. The title isn't about comparing the relative importance of programming languages to getting the answer, but about explaining the tools used and the effort involved in using them.
- thatguy102 2y ago[flagged]
- exe34 2y agoI bet if you used pen and paper occasionally in the process you'd boast "I solved it using pen and paper!"
- ziddoap 2y agoThis is a fun little post about reversing a dreamcast game. No one is being a zealot.
- skinner_ 2y agoInteresting, as a very frequent HN reader, I do not associate this pattern with Python zealots at all. Rust, Swift, Go, more like.
- deleted 2y ago[deleted]
- lpapez 2y agoBy this logic anything meaningful anyone does is actually done with C, because no matter what you do there is 40 million lines of kernel code underneath... "What is the importance of Django, it's only 10 thousand lines of Python, powered by millions of lines of interpreter written in C..."
- throwthis817 2y agoNo, the kernel does not solve the major part of the reverse engineering, the Java application Ghidra does. But Java does not need any marketing, people just quietly use it.
- praptak 2y agoQQRIQ is a phonetic abbreviation of "kukuriku", which is the sound of the rooster in Hungarian and in several other languages (Polish "kukuryku", Hebrew " קוקוריקו" etc.). Makes wonder what the process for choosing the passwords was.
- bt1a 2y agocould it be that the rooster/cockadoodledoo is something performed like clockwork in the morning, so the showing framedata also being tangential to time and clocks ? probably not
- bbayles 2y agoThe programmers for this game were in Budapest, so this is a good guess!
- praptak 2y agoI didn't know that. The QQRIQ jumped out at me because of my Polish background, so I googled it and found it's international.
- jylam 2y agoCocorico in french, very close :)
- bitbasher 2y agoCan we just take a moment to appreciate how incredibly odd the Ecco series is? For anyone that beat the games. You go from swimming in an ocean to flying with aliens. It's bizarre. Some people classify it as a horror game.
- bbayles 2y agoIt really is a game with a strange mix of aesthetics. Blue skies and bright colors in the early levels; suspense and dread and supernatural stuff in the later levels. Another Ed Annunziata game called Three Dirty Dwarves is also stylistically unique.
- nelup20 2y agoMy favorite aspect is the music, I regularly listen to the OST while working: https://youtu.be/tqMuvFEKCOk https://youtu.be/tqMuvFEKCOk I've played a decent amount (never finished it), but I never understood why people say it's a horror game?
- bbayles 2y agoA friend of mine explained that there are overlapping phobias of water and deep dark spaces that this game triggers; he said it's unbearable to play the later levels.
- nelup20 2y agoI just checked what the final boss looks like, combined with the phobias... glad I didn't finish the game as a kid. Thanks for the article, great read!
- Spoom 2y agoI'd imagine anyone with claustrophobia would struggle with the last couple levels as well since they're essentially a battle against the screen crushing you.
- deleted 2y ago[deleted]
- bt1a 2y agoim curious about the process to find that initial buffer address - does that involve entering a few different strings and searching the memory snapshot for those byte patterns ?
- bbayles 2y agoYeah, exactly! I took a couple memory snapshots of the name "AAA" and then threw out all of the addresses that had values that didn't match the first snapshot. Then I changed it to "BBB" and threw out all the addresses that did match. There's a program called Cheat Engine that can make this a point and click thing; that's usually how people find GameShark-style codes.
- VyseofArcadia 2y agoGreat read! Do you have any resources on getting started with Dreamcast game reverse engineering? I've been wanting to do some things with Skies of Arcadia, and I've been hoping there exist techniques more systematic than "see what values change between memory snapshots".
- bbayles 2y agoI've poked around a bit with that game! The main trick is to import the memory snapshot (various ways of dumping it to a file; people like Cheat Engine for this) into Ghidra. Ghidra can analyze the SuperH processor machine code natively, so the auto analysis will turn up lots of functions.
- coldpie 2y ago> I've been hoping there exist techniques more systematic than "see what values change between memory snapshots". FWIW this is pretty much the standard method for locating value locations in RAM. It actually works pretty well. Some emulators have tools built in for that, like Dolphin for example. Even old game hacking tools like the Gameshark for N64 used the technique, with an on-console UI. I don't know if any Dreamcast emulators have tools for it or not. I wrote about the technique in Dolphin here (and the followup article is also about console game hacking with Ghidra): https://www.smokingonabike.com/2021/01/17/hacking-super-monkey-ball-part-1-banana-bunch-values/ https://www.smokingonabike.com/2021/01/17/hacking-super-monk...
- AdmiralAsshat 2y ago> Some emulators have tools built in for that, like Dolphin for example. This was an advertised feature of some DS flashcarts back in the day, too. I can't remember if it was the R4, the DSTwo, or what...but I recall an example video for their "Make your own cheats!" feature, which involved playing something like Super Mario Bros, turning on the "Cheats Finder" feature, then grabbing a coin, and maybe doing it a few times. The manager would then figure out the value that's changing in memory (presumably the sector that stores your coin amount), create the "cheat", and then you would enable it and watch your coin value go up.
- j0hnyl 2y agoI wish there was more detail on "how" this was done as opposed to just the "what"
- nostoc 2y agoIt's very much the "how", what were you looking for that's not explained in the blog post?
- j0hnyl 2y ago--- By analyzing a memory snapshot from the flycast emulator, I found that the buffer at 8cfffb34 holds the visible portion of the initials you type in. But if you keep typing, the characters you put in before get pushed into the buffer at 8c3abf18. After loading the memory snapshot into Ghidra, I found that the function at 8c0334d8 reads this buffer. It performs a transformation on the buffer and then checks whether the transformed value is a list of six special ones. --- How?
- frakt0x90 2y agoI don't know exactly how flycast works but I've done similar things with other emulators and you take an action in the game (take damage, type something), then search memory for that value. In this case the ascii code for the letter typed. Keep doing this until you've narrowed down a single block of memory that holds everything you've done
- qingcharles 2y agoWhen the original Ecco came out on the Megadrive (Genesis), I spent all my hard-earned money to buy it. That game is obscenely hard. I got frustrated, so I sat down for the afternoon with a pen and paper and somehow managed to decode the password system. I teleported to the final level and completed it the next day. Then I was wracked with guilt about spending all my money on a game I completed in two days.
- coldpie 2y ago> I sat down for the afternoon with a pen and paper and somehow managed to decode the password system Would love to hear more about this, if you have any recollection :)
- qingcharles 2y agoI'd love to know how I did it. There must have been a certain element of luck. I actually found the decompiled routine for the password code a couple of years ago and, IIRC, it was surprisingly more sophisticated than my teenage brain would have suspected. https://eccothedolphin.online/ecco-password-generator/ https://eccothedolphin.online/ecco-password-generator/
- VyseofArcadia 2y agoWhat a final level, though! Having skipped a large chunk of the game, were you surprised by it?
- qingcharles 2y agoLOL. I can't remember my reaction at the time. I'd only played through the first few "normal" levels before I got frustrated with the difficulty. I'm sure I was very confused :D
- 7bit 2y agoYou must be the only Person in the world that Beat this Game, cheating or otherwise.
- 29athrowaway 2y agoIs not this against the Ghidra EULA?
- immibis 2y agoIn the real world, no one cares, unless they're on the receiving end of a lawsuit.
- yjftsjthsd-h 2y agoWhat EULA? It looks like https://github.com/NationalSecurityAgency/ghidra https://github.com/NationalSecurityAgency/ghidra says it's Apache 2.0
- saagarjha 2y agoThe one you get when you start it for the first time
- ptek 2y ago> Is this not against the Ghidra EULA? He's not trying to reverse engineer a serial or key file. It's being used for private use. He's not making $$$$ at SEGA's loss. It's not going to destroy SEGA's reputation. and finally they are a hacker so the dopamine hit from being curious will be a big pay off.
- nextlevelwizard 2y agoEven if he was, then what? Quick glance at the repo does not show any kind of End-User License and even if it had what's the NSA going to do? Revoke his license? Sue him?
- nextlevelwizard 2y agocitation needed
- mytaterskin 2y agoI've taken to older games a lot more in recent years, they feel like they have a lot more soul if that makes any sense. Also sorry about your car! Not going to leave it idling in the driveway anymore, thanks for the warning.
- fanoto 2y agoNice! Interesting how similar games seem to do this, checksumming to fixed integers. Pitfall: The Lost Expedition did something very similar by converting button presses into ASCII-represented strings of the input buttons that were then CRC-ed. The approach was similar to just brute-force in Python and compare to the extracted cheat hashes. I even spy your CRC32 table hidden in the `decrypted_ints` . The pre-generated tables are so easily searchable. It leaves me curious why they are so often found obfuscated in attempt to make it more difficult compared to generating a new one with your own polynomial.
- jimmaswell 2y agoThe 3DS version was very cool. I plan on completing it there eventually. I wonder if those devs had source access.
- SideQuark 2y agoThe hash is merely a CRC32; exactly this one (polynomial 0x77073096, code is wrong) https://web.mit.edu/freebsd/head/sys/libkern/crc32.c https://web.mit.edu/freebsd/head/sys/libkern/crc32.c (The decoded ints in the post are the constants in this CRC32). Knowing it's a CRC32 and knowing the polynomial allows inverting the answers in log time instead of exponential time by exploiting the modular math of the polynomial rings.
- byteknight 2y agoI know some of these words!
- Thaxll 2y agoIt means that using bruteforce to find all the values would be much faster.
- dankwizard 2y agoBut OP did Brute Force?
- bbayles 2y ago
- butz 2y agoYou should look into PS2 version of this game, it seems to have same code for level unlock. Maybe it will be easier to reverse engineer and figure out what all codes do?
- Liquix 2y agoan interesting aside: when asked about his inspirations Ecco's developer Ed Annunziata said, "No, I never took LSD, but I did read a lot from John C. Lilly". Lilly is known for his pioneering work in the fields of animal intelligence, ketamine psychotherapy, isolation tanks, and consciousness exploration. The name "Ecco" is a reference to Lilly's ECCO (Earth Coincidence Control Office), a supernatural/extraterrestrial base which John posited existed on the other side of the moon to coordinate all earthly "coincidences". He was also one of the first to recognize how intelligent dolphins were and became obsessed with figuring out how to communicate with them, going as far as flooding half of his house in the Carribeans to cohabitate. This is just the tip of the iceberg. I'd highly recommend his autobiography The Center of the Cyclone if any of this is intriguing, he's a fascinating guy
- n0id34 2y agoI wish more people knew how to change to Ghidra's dark theme and change the font.
- chungy 2y agoMaybe the author likes it this way. People can have preferences that differ from your own.
- Kon-Peki 2y agoWow, a blog that focuses on the Sega Saturn! Not too long ago, I found a Saturn in a closet at my parent’s house, along with a small handful of game CDs. I don’t have any recollection of owning one, so I’m guessing my little brother must have acquired it after I left for college. Anyway, I plugged it in and all the games worked! But other than that I have no idea what to do with it (obviously the trash is not an option).
- wileydragonfly 2y agoThe games are worth a fortune. I gave mine away in 2005 and now I get heart palpitations when I look them up on eBay.
- Kon-Peki 2y agoInteresting. My son suggests getting a table at VCF next year and setting it up for people to play; perhaps I’ll do that and have a sign that says “make an offer”
- Forgeties79 2y agoHave fun! https://terraonion.com/en/producto/terraonion-mode/ https://terraonion.com/en/producto/terraonion-mode/
- pezezin 2y agoYou also have - The Satiator, that plugs into the video card slot so you can still use original CDs. - The Saroo, that plugs into the cartridge slot, also emulates the RAM expansion carts, and it is much cheaper (but seems to have some compatibility problems).
- nanna 2y agoGood to know. Both my Saturn and Dreamcast's optical disk drives have packed up, so I've been wondering what to do with them. The Saroo looks less invasive than the Satiator, and would leave me able to play my old games if I ever get the optical drives working. But since the Saroo blocks up the RAM expansion slot, does it also include that RAM for games that need it?
- wileydragonfly 2y agoAnyone else never beat the second level? Yes, we all eventually figured out that we had to jump over the rock wall… but after that… then what?
- kadoban 2y agoThe next parts I vaguely remember: swim _very_ slow past an octopus arms (there's a hint but it's not necessarily clear that you have to be barely moving at all), hit key crystals and then the corresponding ~door crystals, and push a rock to drop and follow after them to avoid getting pushed back by the current. It's generally a series of puzzles of that form and there's some ~light combat stuff.
- heisenburgzero 2y agoI always wondered where to start learning reverse-engineering. Most people will say learn Assembly first. But from there on, there seems to be not much more concrete information online. Do people just figured it out by trial & error like common patterns in x86 / arm / arcade platforms slowly? I can't really find much discussion on details online.
- bbayles 2y agoI knew some from school, but stepping through a debugger with a video game that I remembered from childhood was a better education on computer engineering than anything I got in class.
- fragmede 2y agorun through http://microcorruption.com http://microcorruption.com or https://crackmes.one/ https://crackmes.one/ for closer to real-life examples
- djmips 2y agoIt's like debugging.. I'm sure you must have worked on an unfamiliar code base at some point and had to figure it out. Instead of having the source you have the binary and using tools like Ghidra you can start to piece together the source but you'll still need to reason over it the very same way you did on that unfamiliar codebase and this time there's no comments at all ( which isn't uncommon in a lot of source available projects mind you ) So you're probably already half way there. Being familiar with assembly code helps of course.
- etra0 2y agoI personally learned a lot by messing in Cheat Engine, it is way more capable than I thought, specially because I mostly used it as a kid and never looked back. It is a great tool to get started with assembly in my opinion because the disassembler is good enough and you can write what they call 'assembly scripts' which provides the foundation on doing memory patches in x86 asm. Then from that you can start writing your own utils to patch the games at your own will. You can do crazy cheats by patching the game just with Cheat Engine!