Hello there, it's me again. Thought some of you might be interested to know what I've been up to in relation to my previous post. I've managed quite a lot, and my progress can be seen here: https://github.com/MicroTransactionsMatterToo/Kain-Disassembly

So far, I've managed to deobfuscate a majority of the program, and last night, I created a patch for the program that re-enables command line arguments, which until recently could only be modified using a hex editor, and only gave you so many characters to work with. I'm now working away on recreating some useful headers/C files so it's more readable.

Many Thanks

Ok guys. I'm primarily concentrating on Soul Reaver at the moment. If you wish to keep a track of progress, you can check it here https://github.com/MicroTransactionsMatterToo/Kain-Disassembly

Ah well. I'll tell you if I find anything interesting :)

So, here is a list of all possible actions Gomez can perform

None,
Idle,
LookingLeft,
LookingRight,
LookingUp,
LookingDown,
Walking,
Running,
Jumping,
FrontClimbingLadder,
BackClimbingLadder,
SideClimbingLadder,
CarryIdle,
CarryWalk,
CarryJump,
CarrySlide,
CarryEnter,
CarryHeavyIdle,
CarryHeavyWalk,
CarryHeavyJump,
CarryHeavySlide,
CarryHeavyEnter,
DropTrile,
DropHeavyTrile,
Throwing,
ThrowingHeavy,
Lifting,
LiftingHeavy,
Dying,
Suffering,
Falling,
Bouncing,
Flying,
Dropping,
Sliding,
Landing,
ReadingSign,
FreeFalling,
CollectingFez,
Victory,
EnteringDoor,
Grabbing,
Pushing,
SuckedIn,
FrontClimbingVine,
FrontClimbingVineSideways,
SideClimbingVine,
BackClimbingVine,
BackClimbingVineSideways,
WakingUp,
OpeningTreasure,
OpeningDoor,
WalkingTo,
Treading,
Swimming,
Sinking,
Teetering,
HurtSwim,
EnteringTunnel,
PushingPivot,
EnterDoorSpin,
EnterDoorSpinCarry,
EnterDoorSpinCarryHeavy,
EnterTunnelCarry,
EnterTunnelCarryHeavy,
RunTurnAround,
FindingTreasure,
IdlePlay,
IdleSleep,
IdleLookAround,
PullUpCornerLedge,
LowerToCornerLedge,
GrabCornerLedge,
GrabLedgeFront,
GrabLedgeBack,
PullUpFront,
PullUpBack,
LowerToLedge,
ShimmyFront,
ShimmyBack,
ToCornerFront,
ToCornerBack,
FromCornerBack,
IdleToClimb,
IdleToFrontClimb,
IdleToSideClimb,
JumpToClimb,
JumpToSideClimb,
ClimbOverLadder,
GrabTombstone,
PivotTombstone,
LetGoOfTombstone,
EnteringPipe,
ExitDoor,
ExitDoorCarry,
ExitDoorCarryHeavy,
LesserWarp,
GateWarp,
SleepWake,
ReadTurnAround,
EndReadTurnAround,
TurnToBell,
HitBell,
TurnAwayFromBell,
CrushHorizontal,
CrushVertical,
DrumsIdle,
DrumsCrash,
DrumsTom,
DrumsTom2,
DrumsToss,
DrumsTwirl,
DrumsHiHat,
VictoryForever,
Floating,
Standing,
StandWinking,
IdleYawn

So, I decompiled Fez, cause it's written in .NET, which is reallllly easy to reverse-engineer. It's not illegal, as reverse-engineering for any purpose other than directly to circumvent DRM is not actually clearly defined in law ^^; I don't think I can distribute the source, but I should be able to find interesting bugs/cool things by debugging the game as it's run

@Gyoo Soz. I'll keep that in mind next time :)

Well, if I can emulate it, I can find things more easily, but the one I'm working on currently is a PC game from 1999, and I've also dug into PS2 games as well. I'm willing to take a crack at most things, but I can only do so much. I also have to manage school as well

Hey, @TheDuriel, I'm uploading some testing footage to YouTube. It has the debugger console in the bottom left, so that should be interesting. Might prove to be nothing new to you, but there seem to be odd collisions in corners where Kain thinks he's pushing a box or something, and sort of derps out. Also, there's a platform near the beginning of the training segment that has extremely broken collision. I played with it a bit in the game, as well as some buggy water systems i found.

@TheDuriel Well, after attaching a debugger, it looks like it'll be easy to locate load-planes. The program prints "cached unit levelName" when a loadplane is triggered. If this is helpful, I can probably spend a bit of time playing with it. As well as that, I got a load of messages about prims in OTags, which only appeared on accessing the pause menu. It seems to be primarily related to saving, if my suspicions are correct. Given that the program prints debugging info, I should be able to find and properly dissect the subroutines associated with aforementioned logging, and I should be able to make a start on properly reverse-engineering the game engine

@TheDuriel Yeah. I'll take a deeper look into it when I have time. If I use the playstation version I should be able to de-obfuscate a decent amount of bits of code. Also, just wanted to make sure you read the other parts. Next thing I'm going to try is attaching a debugger to the game as it runs, and seeing what changes depending on certain actions. As well as that, the game seems to be pretty fun, although the controls on PC are a bit wonky

@Timmiluvs Yeah. It's an open-source effort to put the original PS2 SDK back together. It's not the original, but as far as I can tell it's damn close

@Timmiluvs I primarily use a mixture of the unix command cat and IDA disassembler. IDA supports both PS2 and PS1 binary files, as well as NES and GB/GBC binaries, as well as others I can't remember. It is paid, but I believe that the version 4.1.2 was the last free one. I also used google, and am in the midst of attempting to compile the PS2SDK project, so I can make some of the disassembled names a bit more readable. Hope this helps

@Ozotuh I managed to decompile the game, but it doesn't look like there's going to be much luck there. I'm currently working on compiling the PS2 SDK so I can load it's debugging symbols, but I can't guarantee it'll work

I'll take a look. I can't actually play the game, as my laptop is too shitty to emulate a PS2, but I can disassemble it and take a look into it

Ok, @TheDuriel. I did a bit of digging, and found some useful stuff regarding the engine that Soul Reaver uses. It uses an updated and modified version of Gex 3's engine, and has some possible exploits due to it's loading system. See this article http://www.thelostworlds.net/TechDocs/Soul_Reavers_Gex_Engine.html for more useful info. As well as that, I found it was compiled using Microsoft Visual C++ v6, and was designed primarily for Windows XP. The file locals.pc seems to contain dialogue from the playstation version, and is primarily related to memory cards and saving, as well as controls. It uses Bink Video for it's prerendered cutscenes, and the rest seem to be done in the games engine. From memory address 0x004FB30C to 0x004FB407, some of the games level names appear to be stored. Most of the actual function names from the game are mangled by the C++ compiler, and as I don't have header files or debugging symbols, it's a bit difficult to pick it apart from that point without some extensive frame-by-frame type debugging and watching values carefully

@TheDuriel Challenge accepted m9

Yo. Pretty new here, but thought I'd just make a post for this.

I'm fairly decent at reverse engineering games and finding either just interesting things or possible exploits. If you're interested, hit me up :) I don't have a lot of time, due to school, but I'll do the best I can.

Thought I should probably note that my computer is too shitty to handle streaming. We have fibre broadband here, so Twitch thinks my stream is amazing quality, despite the fact it's stuck on one frame, because there aren't any frames to drop. Currently building my PC, just waiting to get the CPU, and the fan, and then I should be able to stream something at least

Hello, just thought I'd leave a note here. New to speedrunning, and planning on running CrossCode when it's finished. As well as that, I'm a fairly experienced developer, and have an above average knowledge of the NES/SNES internals and workings. I can probably help with pulling apart games to find glitches, if that's done. Hope I can help out, and that I become a valuable member of the community :)