diff --git a/404.md b/404.md index c063f2ca..c683ce52 100644 --- a/404.md +++ b/404.md @@ -3,4 +3,5 @@ permalink: /404.html layout: 404 title: Page Not Found --- + Custom 404 (See 404.html layout) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index cc75b823..931c06c1 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -60,24 +60,6 @@ We want to avoid spreading misinformation as much as possible, which can be tric # Formatting Guidelines Posts are written in [GitHub Flavored Markdown](https://github.github.com/gfm/) but also support additional Jekyll includes that can be used for more advanced components. -When a section is listing folder contents, prefer the existing includes over raw HTML or plain bullet dumps: -* Use `connected-folder-tree.html` when showing folders with subfolders or a nested directory structure - `folder` should be the short display name and `path` should be the longer location, for example `folder="trunk"` and `path="agb_bootrom/trunk"` - -When referencing a real source file: -* Use `source-code-card.html` and/or `source-code-card-grid.html` when you are actually showing the contents of a source file, such as its functions, variables, structs, or other internal symbols -* Its best to float the code card to the side of the text with the `rr-code-card-aside` class and use it in sections talking about that source file. -* Don't have the exact same code card in multiple sections of the same article -* Do not use code cards just to summarize what a file is for or what companion files sit beside it - use a table or normal prose for that instead -* The `functions`, `variables`, and `lines` fields on code cards must be exact numeric counts taken from the file contents, not descriptive text or estimates -* If the exact counts are not known yet, leave the card out until the file has been inspected properly enough to count them -* In a code-card item like `type::name::extra`, the final `extra` field is for function arguments only -* For variables and other non-function symbols, leave the final field blank - Wrong: `- function::SAVE_FILE1::save wrapper for the first editor family` - Better: `- function::SAVE_FILE1::()` - Better: `- variable::Log_Format_2HD` -* Prefer these includes over hand-written decorative HTML so the styling stays consistent across the site - ## Writing Style Rules
🔤
@@ -102,26 +84,19 @@ We try to maintain consistent characters here are the main rules: * **Dashes** - For dashes, always use `-` and never `—` (em dash). * **Standards only** - Don't use characters that are not on standard keyboards. -## List Rules -
🔹
- -Lists can improve readability when used appropriately but should only be used when the context makes sense. -We mainly use unordered lists (Markdown: `*`); only use ordered lists (Markdown: `-`) if there is a specific reason to do so. - -If using a list, we have a preferred format for lists where each list item has a short bold part followed by a dash (-) and more information: -```markdown -First we always have a short sentence introducing the list: -* **Item title in bold** - More information about the item -```` - -Always have a sentence before the list explaining the list, never just have a list after a heading. - -However, if the list is too long (e.g. more than 10 items), use a Markdown table instead. The site supports searching within Markdown tables, which is not useful for short lists but ideal for long ones. +### Spelling +We have automated spell checking with cspell but sometimes debug symbols and other technical terms may need to be excluded, if there is a big block of them you can you the following: +``` + +debug symbols that are not spelled correctly but we want to keep for accuracy + +``` -## Table Rules -* NEVER use excessive spacing in Markdown tables. -* Rows in Markdown tables should not start or end with `|` as Markdown handles this automatically. +## Table of Contents +* Do not generate your own table of contents as tyhis will be done at runtime based on the H1/H2/H3 etc elements. +* But DO make sure to use the full range of headings from H1->H5 +--- ## Markdown Rules Our pages tend to be broken up into different sections based on headings, headings are used for the table of contents and can be treated as distinct sections. @@ -133,12 +108,32 @@ Here are some of the markdown rules: * **Use HR when jumping back up the heading hierarchy** - If a section ends at a deeper heading level and the next heading jumps back up, add a Markdown HR (`---`) immediately before the higher-level heading. For example, if an H4 section is followed by a new H1, place `---` directly before the H1. * **No line between HR and Heading** - the next line after a HR (`---`) should be the heading itself * **No line between heading and first paragraph** - the next line after a heading should always be the first paragraph of the section -* **Never use numbered lists** - Just use `*` for all unordered lists. * **Short inline code** - If the code is short, wrap it with backticks (e.g. `eax, 0x00`). * **Don't mix bold and inline code** - Avoid `**\`literal\`**` styling. Use backticks for literals (commands, file names, extensions) and bold for emphasis, but not both at the same time. * **HR before H2/H3** - Have an HR before HR/H3 but only if its not the first sub heading under a heading +### List Rules +
🔹
+ +Rules for lists: +* Lists can improve readability when used appropriately but should only be used when the context makes sense, don't overuse lists. +* **Never use numbered lists** - Just use `*` for all unordered lists. +* **Always have a sentence before the list** explaining the list, never just have a list after a heading. + +If using a list, we have a preferred format for lists where each list item has a short bold part followed by a dash (-) and more information: +```markdown +First we always have a short sentence introducing the list: +* **Item title in bold** - More information about the item +``` + +However, if the list is too long (e.g. more than 10 items), use a Markdown table instead. The site supports searching within Markdown tables, which is not useful for short lists but ideal for long ones. + +### Table Rules +* NEVER use excessive spacing in Markdown tables. +* Rows in Markdown tables should not start or end with `|` as Markdown handles this automatically. + + ### Glossary Rules * **Add a glossary for acronym-heavy pages** - If a page uses many technical acronyms or specialist terms, add a short glossary near the top. * **Link first mention per section** - For glossary terms, link the first meaningful mention in each section to the glossary definition; avoid linking every occurrence. @@ -166,13 +161,12 @@ tags: - gameboy - leak title: Example Page Title -category: leak +category: gameboy # category can also be a list when a page belongs to multiple areas: # category: +# - gameboy # - leak -# - snes image: /public/images/example.jpg -twitterimage: https://www.retroreversing.com/public/images/example.jpg permalink: /example-page breadcrumbs: - name: Home @@ -197,7 +191,7 @@ Field | Purpose `tags` | Search/discovery tags for the page, and the values other pages match against in their `recommend` lists, only use valid tags from `valid-tags.json` `title` | Full page title shown in the page header and metadata (do not use colons! as it messes with the yaml frontmatter) `category` | Main site grouping such as the games console name or others such as `leak`, `introduction`, `gameengines`, `maths`, or another section-specific category. This can be a single value (`category: leak`) or a list (`category: [leak, snes]`) when a page belongs to multiple categories. -`image` | Main preview image used by the page and site cards, if there is not a unique one leave it blank and it will be generated based on the category and title, if in doubt leave blank +`image` | Optional main preview image used by the page and site cards, if there is not a unique one leave it blank and it will be generated based on the category and title, for new pages leave blank (don't include) `twitterimage` | Absolute URL version of the preview image for social sharing, leave blank and it will be generated, if in doubt leave blank `permalink` | Final public path for the page (do not end with a trailing `/`; that is legacy format we are moving away from) `breadcrumbs` | Breadcrumb trail shown at the top of the page @@ -275,11 +269,32 @@ Sandpack can be used to run react/typescript: ``` ### Binary Parser -See []../tools/n64RomViewer.html](../tools/n64RomViewer.html) +See [../tools/n64RomViewer.html](../tools/n64RomViewer.html) ``` file-parse.html include ``` +## Folder listings +When a section is listing folder contents, prefer the existing includes over raw HTML or plain bullet dumps: +* Use `connected-folder-tree.html` when showing folders with subfolders or a nested directory structure + `folder` should be the short display name and `path` should be the longer location, for example `folder="trunk"` and `path="agb_bootrom/trunk"` + +Example: +```markdown +## The FZERO Source code directory (/src/FZERO) +The FZERO folder si where the main source code live and it contains the following sub-directories: +{% capture fzero_root_body %} +The archive is split very neatly into the game itself and the DOS-side tools used to generate its content. +{% endcapture %} + +{% capture folder_items %} +- Game - Assembly source code for the game +- Tools - C source code for the tools used to make the game +{% endcapture %} + +{% include connected-folder-tree.html folder="FZERO" path="/src/FZERO" body=fzero_root_body version="/" content=folder_items %} +``` + --- # Tips for making the pages more visually engaging and readable
💡
@@ -390,6 +405,41 @@ sleep(1); {% endraw %} +--- + +## Code Cards +When referencing a real source file: +* Use `source-code-card.html` and/or `source-code-card-grid.html` when you are actually showing the contents of a source file, such as its functions, variables, structs, or other internal symbols +* Its best to float the code card to the side of the text with the `rr-code-card-aside` class and use it in sections talking about that source file. +* Don't have the exact same code card in multiple sections of the same article +* Do not use code cards just to summarize what a file is for or what companion files sit beside it - use a table or normal prose for that instead +* The `functions`, `variables`, and `lines` fields on code cards must be exact numeric counts taken from the file contents, not descriptive text or estimates +* If the exact counts are not known yet, leave the card out until the file has been inspected properly enough to count them +* In a code-card item like `type::name::extra`, the final `extra` field is for function arguments only +* For variables and other non-function symbols, leave the final field blank + Wrong: `- function::SAVE_FILE1::save wrapper for the first editor family` + Function: `- void::SAVE_FILE1::()` + Variable: `- int::Log_Format_2HD` +* Prefer these includes over hand-written decorative HTML so the styling stays consistent across the site + +### Example floating Code card +```markdown +{% capture sfxdos_core_items %} +- void::press_slit::(FILE *rp, FILE *wp) +- int::fgetw::(FILE *fp) +- struct STACK::bomb[MAXBOMB] +- int::bomb_count +{% endcapture %} + +
+ {% include_cached source-code-card.html title="sfxdos.asm" items=sfxdos_core_items functions="4" variables="8" lines="400" class="rr-file-card-aside" %} +
+ The heart of the stack is `sfxdos.asm`. + Its header calls it a `Super Famicom Disk Operation System special version`, programmed by **Y. Nishida** on **29 October 1991**. +
+
+``` + --- # Technical implementation This section is for lower level programming details about how some of the features on the site work. @@ -419,8 +469,6 @@ To improve performance, this site uses a custom JavaScript-based lazy loading sy Any `` element with the class `lazy-load` and a `data-image-full` attribute will be lazy loaded. The `src` attribute is set dynamically by JavaScript when the image is about to come into view. -### How to use -
📝
You can use it like so: ```html Description @@ -428,13 +476,6 @@ You can use it like so: You may set a low-res or placeholder `src` if desired, or leave it blank. When the image scrolls into view, the script will set `src` to the value of `data-image-full`. -### Where it is used -It is already used in the following places: -* Home page cards (`_includes/home-card.html`) -* Post and site link includes (`_includes/link-to-other-post.html`, `_includes/link-to-other-site.html`) -* Placeholder images (`_includes/placeholder-post-image.html`) -* Directly in markdown files (e.g., `categories/misc/Books.md`) - --- ## Lightbox Gallery The site uses a jQuery-based lightbox plugin (`public/js/lightbox.js`) to display images in a modal overlay with optional gallery navigation. diff --git a/categories/Introduction.md b/categories/Introduction.md index 48ef26bd..0978d946 100644 --- a/categories/Introduction.md +++ b/categories/Introduction.md @@ -257,8 +257,8 @@ API functions are very useful when reversing a game or application as they tend ## How are APIs distributed? APIs are typically distributed in several ways to allow developers to integrate them into their applications: -- **Static Libraries** - Provided as .lib (Windows) or .a (Unix-like systems) files that developers link to their applications at compile time. -- **Dynamic Libraries** - Provided as .dll (Windows) or .so (Unix-like systems) files, which are linked at runtime. +* **Static Libraries** - Provided as .lib (Windows) or .a (Unix-like systems) files that developers link to their applications at compile time. +* **Dynamic Libraries** - Provided as .dll (Windows) or .so (Unix-like systems) files, which are linked at runtime. --- ## What is a Static Library? @@ -273,45 +273,45 @@ A dynamic library is a file containing code and data that can be used by multipl ### Which DLLs are used by code compiled by versions of Microsoft Visual C++? Here's a table of Microsoft Visual C++ (MSVC) versions and their associated runtime DLLs that can be imported. This table provides a quick reference for understanding which runtime DLLs correspond to different versions of MSVC. -| **MSVC Version** | **Runtime DLLs** | **DLL File Names** | -|------------------|----------------------------------------|-------------------------------------------------| -| **MSVC 6.0** | Visual C++ 6.0 runtime | `MSVCRT.dll` | -| **MSVC 7.0** | Visual Studio .NET 2002 (VC7) | `MSVCRT.dll`, `MSVCP60.dll` | -| **MSVC 7.1** | Visual Studio .NET 2003 (VC7.1) | `MSVCRT.dll`, `MSVCP71.dll` | -| **MSVC 8.0** | Visual Studio 2005 (VC8) | `MSVCRT.dll`, `MSVCP80.dll`, `MSVCR80.dll` | -| **MSVC 9.0** | Visual Studio 2008 (VC9) | `MSVCRT.dll`, `MSVCP90.dll`, `MSVCR90.dll` | -| **MSVC 10.0** | Visual Studio 2010 (VC10) | `MSVCRT.dll`, `MSVCP100.dll`, `MSVCR100.dll` | -| **MSVC 11.0** | Visual Studio 2012 (VC11) | `MSVCRT.dll`, `MSVCP110.dll`, `MSVCR110.dll` | -| **MSVC 12.0** | Visual Studio 2013 (VC12) | `MSVCRT.dll`, `MSVCP120.dll`, `MSVCR120.dll` | -| **MSVC 14.0** | Visual Studio 2015 (VC14) | `MSVCRT.dll`, `MSVCP140.dll`, `MSVCR140.dll` | -| **MSVC 14.1** | Visual Studio 2017 (VC14.1) | `MSVCRT.dll`, `MSVCP140.dll`, `MSVCR140.dll` | -| **MSVC 14.2** | Visual Studio 2019 (VC14.2) | `MSVCRT.dll`, `MSVCP140.dll`, `MSVCR140.dll` | -| **MSVC 15.0** | Visual Studio 2022 (VC15) | `MSVCRT.dll`, `MSVCP140.dll`, `MSVCR140.dll` | +**MSVC Version** | **Runtime DLLs** | **DLL File Names** +------------------|----------------------------------------|------------------------------------------------- +**MSVC 6.0** | Visual C++ 6.0 runtime | `MSVCRT.dll` +**MSVC 7.0** | Visual Studio .NET 2002 (VC7) | `MSVCRT.dll`, `MSVCP60.dll` +**MSVC 7.1** | Visual Studio .NET 2003 (VC7.1) | `MSVCRT.dll`, `MSVCP71.dll` +**MSVC 8.0** | Visual Studio 2005 (VC8) | `MSVCRT.dll`, `MSVCP80.dll`, `MSVCR80.dll` +**MSVC 9.0** | Visual Studio 2008 (VC9) | `MSVCRT.dll`, `MSVCP90.dll`, `MSVCR90.dll` +**MSVC 10.0** | Visual Studio 2010 (VC10) | `MSVCRT.dll`, `MSVCP100.dll`, `MSVCR100.dll` +**MSVC 11.0** | Visual Studio 2012 (VC11) | `MSVCRT.dll`, `MSVCP110.dll`, `MSVCR110.dll` +**MSVC 12.0** | Visual Studio 2013 (VC12) | `MSVCRT.dll`, `MSVCP120.dll`, `MSVCR120.dll` +**MSVC 14.0** | Visual Studio 2015 (VC14) | `MSVCRT.dll`, `MSVCP140.dll`, `MSVCR140.dll` +**MSVC 14.1** | Visual Studio 2017 (VC14.1) | `MSVCRT.dll`, `MSVCP140.dll`, `MSVCR140.dll` +**MSVC 14.2** | Visual Studio 2019 (VC14.2) | `MSVCRT.dll`, `MSVCP140.dll`, `MSVCR140.dll` +**MSVC 15.0** | Visual Studio 2022 (VC15) | `MSVCRT.dll`, `MSVCP140.dll`, `MSVCR140.dll` Notes: -- **MSVCRT.dll** is the Microsoft C Runtime Library used across various versions. -- **MSVCPxx.dll** refers to the Microsoft C++ Runtime Library, where `xx` denotes the version (e.g., `80` for Visual Studio 2005). -- **MSVCRxx.dll** refers to the Microsoft C Runtime Library versioned similarly to the `MSVCPxx.dll`. +* **MSVCRT.dll** is the Microsoft C Runtime Library used across various versions. +* **MSVCPxx.dll** refers to the Microsoft C++ Runtime Library, where `xx` denotes the version (e.g., `80` for Visual Studio 2005). +* **MSVCRxx.dll** refers to the Microsoft C Runtime Library versioned similarly to the `MSVCPxx.dll`. ### What tools are used to explore Executables and Compiled Libraries? Here's a table summarizing the tools for viewing the insides of executables and libraries: -| **Tool** | **Platform** | **Description** | **Usage** | -|-------------------------|---------------------------------|-----------------------------------------------------------------------------------------------|---------------------------------------------------------------------------| -| **objdump** | Linux, Unix, macOS, Windows | Disassembles and displays information about object files and executables. | `objdump -d ` for disassembly, `objdump -t ` for symbols. | -| **readelf** | Linux, Unix | Displays detailed information about ELF files, including headers and segments. | `readelf -h ` for headers, `readelf -s ` for symbols. | -| **nm** | Linux, Unix, macOS, Windows | Lists symbols from object files, executables, and libraries. | `nm `. | -| **gdb** | Linux, Unix, macOS, Windows | Debugger that can also inspect executable contents, disassemble code, and view symbols. | `gdb `, then use commands like `info functions` or `disassemble`. | -| **Ghidra** | Windows, Linux, macOS | Free and open source disassembler and debugger with interactive analysis capabilities. | Load the executable into Ghidra and use the GUI for exploration. | -| **IDA Pro** | Windows, Linux, macOS | Commercial disassembler and debugger with interactive analysis capabilities. | Load the executable into IDA Pro and use the GUI for exploration. | -| **Hex-Rays Decompiler** | Windows, Linux, macOS | Converts disassembled code back to C-like pseudo code; an add-on for IDA Pro. | Integrated within IDA Pro; select a function and decompile. | -| **Binary Ninja** | Windows, Linux, macOS | Modern binary analysis tool with disassembly, decompilation, and scripting. | Load the binary and use the GUI or API for analysis. | -| **Radare2** | Windows, Linux, macOS | Open-source framework for reverse engineering, including disassembly and debugging. | `r2 `, then use commands like `pdf` to disassemble functions. | -| **PE Explorer** | Windows | Commercial tool for inspecting and editing Windows PE files. | Open the executable in PE Explorer and navigate through sections. | -| **CFF Explorer** | Windows | Free tool for analyzing and editing PE files, with detailed views of file structure. | Open the PE file in CFF Explorer and explore different sections. | -| **Dependency Walker** | Windows | Analyzes dependencies of Windows executables and DLLs, showing imported/exported functions. | Load the executable or DLL in Dependency Walker and explore dependencies. | -| **dumpbin** | Windows (Visual Studio) | Command-line tool for inspecting PE files, showing headers, symbols, imports, and more. | `dumpbin /all ` to view all available information. | -| **MachOView** | macOS | Tool for viewing the structure of Mach-O binaries, native to macOS executables. | Open the Mach-O binary in MachOView and browse its segments and sections. | +**Tool** | **Platform** | **Description** | **Usage** +-------------------------|---------------------------------|-----------------------------------------------------------------------------------------------|--------------------------------------------------------------------------- +**objdump** | Linux, Unix, macOS, Windows | Disassembles and displays information about object files and executables. | `objdump -d ` for disassembly, `objdump -t ` for symbols. +**readelf** | Linux, Unix | Displays detailed information about ELF files, including headers and segments. | `readelf -h ` for headers, `readelf -s ` for symbols. +**nm** | Linux, Unix, macOS, Windows | Lists symbols from object files, executables, and libraries. | `nm `. +**gdb** | Linux, Unix, macOS, Windows | Debugger that can also inspect executable contents, disassemble code, and view symbols. | `gdb `, then use commands like `info functions` or `disassemble`. +**Ghidra** | Windows, Linux, macOS | Free and open source disassembler and debugger with interactive analysis capabilities. | Load the executable into Ghidra and use the GUI for exploration. +**IDA Pro** | Windows, Linux, macOS | Commercial disassembler and debugger with interactive analysis capabilities. | Load the executable into IDA Pro and use the GUI for exploration. +**Hex-Rays Decompiler** | Windows, Linux, macOS | Converts disassembled code back to C-like pseudo code; an add-on for IDA Pro. | Integrated within IDA Pro; select a function and decompile. +**Binary Ninja** | Windows, Linux, macOS | Modern binary analysis tool with disassembly, decompilation, and scripting. | Load the binary and use the GUI or API for analysis. +**Radare2** | Windows, Linux, macOS | Open-source framework for reverse engineering, including disassembly and debugging. | `r2 `, then use commands like `pdf` to disassemble functions. +**PE Explorer** | Windows | Commercial tool for inspecting and editing Windows PE files. | Open the executable in PE Explorer and navigate through sections. +**CFF Explorer** | Windows | Free tool for analyzing and editing PE files, with detailed views of file structure. | Open the PE file in CFF Explorer and explore different sections. +**Dependency Walker** | Windows | Analyzes dependencies of Windows executables and DLLs, showing imported/exported functions. | Load the executable or DLL in Dependency Walker and explore dependencies. +**dumpbin** | Windows (Visual Studio) | Command-line tool for inspecting PE files, showing headers, symbols, imports, and more. | `dumpbin /all ` to view all available information. +**MachOView** | macOS | Tool for viewing the structure of Mach-O binaries, native to macOS executables. | Open the Mach-O binary in MachOView and browse its segments and sections. ### How do I find out what compiler/linker was used to build an executable? Detect It Easy showing the Compile and Linker for Game Maker 1.1 executable @@ -355,16 +355,16 @@ Note that the above are the rough groups, some specific CPUs have more specialis ### How similar are Instruction Set Architectures Here is a simple comparison table that highlights some key differences between different CPU Instruction Set Architectures (ISA). Please note that this table is not exhaustive and focuses on high-level distinctions: -| ISA | Example Instructions | Number of Registers | Memory Addressing Modes | Complex Instructions | Endianness | -|-------------|----------------------|---------------------|-------------------------|-----------------------|------------| -| Z80 | ADD, SUB, MOV | 8 General Purpose | Immediate, Direct, Indexed, Register Indirect | Conditional Jumps, Bit Manipulation | Little-Endian | -| 6502 | ADC, LDA, STA | 3 General Purpose | Zero Page, Absolute, Indexed, Indirect | None | Little-Endian | -| 68K | ADD, SUB, MOVE | 16 General Purpose | Register Direct, Immediate, Memory Indirect | Multiply, Divide, Bit Manipulation | Big-Endian | -| MIPS | ADD, SUB, LW | 32 General Purpose | Immediate, Register Direct, Base + Offset | Load/Store, Multiply, Divide | Big-Endian | -| x86 | ADD, SUB, MOV | 8 General Purpose | Register Direct, Immediate, Memory Indirect | Complex Arithmetic, SIMD | Little-Endian | -| ARM | ADD, SUB, LDR | 16 General Purpose | Immediate, Register Direct, Base + Offset | SIMD, Multiply, Divide | Little-Endian | -| SuperH | ADD, SUB, MOV | 16 General Purpose | Immediate, Register Direct, Memory Indirect | Multiply, Divide, Bit Manipulation | Little-Endian | -| PowerPC | ADD, SUB, LWZ | 32 General Purpose | Immediate, Register Direct, Base + Offset | SIMD, Multiply, Divide | Big-Endian | +ISA | Example Instructions | Number of Registers | Memory Addressing Modes | Complex Instructions | Endianness +-------------|----------------------|---------------------|-------------------------|-----------------------|------------ +Z80 | ADD, SUB, MOV | 8 General Purpose | Immediate, Direct, Indexed, Register Indirect | Conditional Jumps, Bit Manipulation | Little-Endian +6502 | ADC, LDA, STA | 3 General Purpose | Zero Page, Absolute, Indexed, Indirect | None | Little-Endian +68K | ADD, SUB, MOVE | 16 General Purpose | Register Direct, Immediate, Memory Indirect | Multiply, Divide, Bit Manipulation | Big-Endian +MIPS | ADD, SUB, LW | 32 General Purpose | Immediate, Register Direct, Base + Offset | Load/Store, Multiply, Divide | Big-Endian +x86 | ADD, SUB, MOV | 8 General Purpose | Register Direct, Immediate, Memory Indirect | Complex Arithmetic, SIMD | Little-Endian +ARM | ADD, SUB, LDR | 16 General Purpose | Immediate, Register Direct, Base + Offset | SIMD, Multiply, Divide | Little-Endian +SuperH | ADD, SUB, MOV | 16 General Purpose | Immediate, Register Direct, Memory Indirect | Multiply, Divide, Bit Manipulation | Little-Endian +PowerPC | ADD, SUB, LWZ | 32 General Purpose | Immediate, Register Direct, Base + Offset | SIMD, Multiply, Divide | Big-Endian This table provides a broad overview of these architectures, but there are many more details and specific instructions within each ISA. The number of registers, addressing modes, and the availability of complex instructions can significantly vary even within a single architecture, and the choice of endianness (byte order) can have important implications for software compatibility. For a deep dive into any of these ISAs, you would typically need to consult the official documentation or specific resources for each architecture. @@ -409,12 +409,12 @@ The CPU also works with other parts of the console, like the graphics and sound An instruction is a basic operation or command that the CPU can execute. These instructions are written in a machine-readable form, usually in binary code, and are the fundamental building blocks of a computer program. Each CPU has its own specific set of instructions, known as its instruction set architecture (ISA). Instructions can perform various tasks, such as: -1. **Arithmetic Operations**: These include instructions for addition, subtraction, multiplication, division, and other mathematical operations. -2. **Data Movement**: Instructions for moving data between registers, memory, and other storage locations. -3. **Control Flow**: Instructions that control the program's flow, such as branching (jumping to a different part of the program) or conditional execution (if-then-else). -4. **Logical Operations**: Instructions for performing logical operations like AND, OR, XOR, and NOT. -5. **Load and Store**: These instructions load data from memory into registers or store data from registers back into memory. -6. **Input/Output**: Instructions that allow the CPU to interact with input and output devices like keyboards, displays, and storage devices. +* **Arithmetic Operations**: These include instructions for addition, subtraction, multiplication, division, and other mathematical operations. +* **Data Movement**: Instructions for moving data between registers, memory, and other storage locations. +* **Control Flow**: Instructions that control the program's flow, such as branching (jumping to a different part of the program) or conditional execution (if-then-else). +* **Logical Operations**: Instructions for performing logical operations like AND, OR, XOR, and NOT. +* **Load and Store**: These instructions load data from memory into registers or store data from registers back into memory. +* **Input/Output**: Instructions that allow the CPU to interact with input and output devices like keyboards, displays, and storage devices. CPU instructions are executed sequentially, one after the other, according to the program's logic. The order and combination of these instructions determine the behavior of a computer program. @@ -463,7 +463,6 @@ The CPU has designated instructions to read and write from the stack, often call When you need to store more data than the stack can handle or require memory that persists longer than a single function call, the heap comes into play. The heap is another part of your computer's RAM, used for dynamic memory allocation, such as storing large objects, game assets, or variables that need to exist throughout the program's execution. ## What is the Heap? - You can think of the heap as a large pool of memory where you can request chunks of memory as needed. Unlike the stack, memory in the heap can be allocated and freed in any order, making it flexible but also more complex to manage. ## Which systems had a heap? @@ -472,18 +471,15 @@ Early video game consoles typically **did not have a heap** due to their limited Some heaps were handled by the operating system (Xbox onwards) and others were handled by the game engines themselves (PS2, GameCube). ## How does the Heap grow? - The heap grows upwards, from lower to higher memory addresses. When you request more memory (for example, creating a new object or allocating an array), the heap expands towards higher addresses. This is in contrast to the stack, which grows downwards, ensuring that both areas can grow without quickly overlapping. ## Why is the Heap important? - -The heap is essential for managing memory in programs where the amount of data isn't known ahead of time or varies during execution. It’s particularly useful in situations where you need to allocate large blocks of memory that might need to exist for the lifetime of the program or until explicitly freed. +The heap is essential for managing memory in programs where the amount of data isn't known ahead of time or varies during execution. It's particularly useful in situations where you need to allocate large blocks of memory that might need to exist for the lifetime of the program or until explicitly freed. ## How do you interact with the Heap? - Most programming languages provide functions or operators to allocate and free memory on the heap. In languages like C, `malloc()` and `free()` are used, while in higher-level languages like Python or Java, memory management on the heap is handled automatically through built-in mechanisms. -This allows you to dynamically allocate space when needed and release it when it’s no longer required, making the heap a powerful tool for managing memory in complex programs. +This allows you to dynamically allocate space when needed and release it when it's no longer required, making the heap a powerful tool for managing memory in complex programs. Interacting with the heap in assembly language typically involves system calls or interrupts to request memory from the operating system. Unlike the stack, which is managed directly by the CPU with specific instructions, the heap requires explicit requests for memory allocation and deallocation. @@ -526,11 +522,11 @@ Conventions also decide who is responsible for cleaning up the stack after the f ### thiscall thiscall is a calling convention used primarily for C++ member functions. It is designed to handle the specific needs of methods that operate on objects (i.e. functions that are part of a class). -- **Arguments**: Used primarily for C++ member functions. -- **First Argument**: The this pointer (the instance of the object) is passed in a specific register (ecx on x86). -- **Additional Arguments**: Passed on the stack. -- **Cleanup**: The callee cleans up the stack. -- **Return Value**: Typically returned in the eax register. +* **Arguments**: Used primarily for C++ member functions. +* **First Argument**: The this pointer (the instance of the object) is passed in a specific register (ecx on x86). +* **Additional Arguments**: Passed on the stack. +* **Cleanup**: The callee cleans up the stack. +* **Return Value**: Typically returned in the eax register. --- ## Function Prologue and Epilogue @@ -538,7 +534,7 @@ Disassemblers often rely on function prologues and epilogues as key indicators f ### Function Prologue
🔜
-The prologue is the sequence of instructions at the beginning of a function that prepares the stack and registers for the function’s execution. It typically includes saving the return address, preserving the base pointer (if used), and allocating space on the stack for local variables. +The prologue is the sequence of instructions at the beginning of a function that prepares the stack and registers for the function's execution. It typically includes saving the return address, preserving the base pointer (if used), and allocating space on the stack for local variables. **Example (x86 Architecture)**: ```assembly @@ -567,13 +563,12 @@ Here are simple examples of making a system call in assembly on Windows, Linux, ### Windows (x86) System Call Example In Windows, system calls can be made directly using two different methods depending on which version of windows: -- **`int 0x2e`**: This interrupt vector was historically used to invoke system calls by placing the syscall number in `eax` and issuing the interrupt. This method is deprecated and replaced by `SYSENTER`. -- **`SYSENTER`**: This instruction is optimized for making system calls on modern x86 processors. Windows sets up the MSRs (Model-Specific Registers) required for `SYSENTER` during boot, so user-mode applications don't need to manage them. However, this approach is not documented for use in applications and is generally intended for internal OS use. +* `int 0x2e`: This interrupt vector was historically used to invoke system calls by placing the syscall number in `eax` and issuing the interrupt. This method is deprecated and replaced by `SYSENTER`. +* `SYSENTER`: This instruction is optimized for making system calls on modern x86 processors. Windows sets up the MSRs (Model-Specific Registers) required for `SYSENTER` during boot, so user-mode applications don't need to manage them. However, this approach is not documented for use in applications and is generally intended for internal OS use. Directly invoking system calls using `int 0x2e` or `SYSENTER` is highly discouraged in normal application development due to the risk of instability and compatibility issues across different Windows versions. Instead, using the Windows API (like `ExitProcess`) is the recommended and supported approach. -#### Using `int 0x2e` (pre-Windows XP) - +#### Using int 0x2e (pre-Windows XP) The `int 0x2e` interrupt was used in older versions of Windows (pre-Windows XP) to invoke system calls directly. Here's an example: ```assembly @@ -598,7 +593,6 @@ _start: ``` #### Using SYSENTER (Modern Method) - `SYSENTER` is a fast system call instruction introduced with Intel's Pentium II processors and is used internally by Windows for system calls on newer systems. This approach requires setting up specific registers before the `SYSENTER` instruction is executed: ```assembly diff --git a/categories/companies/Codemasters.md b/categories/companies/Codemasters.md index a6954f27..a28cfa0c 100644 --- a/categories/companies/Codemasters.md +++ b/categories/companies/Codemasters.md @@ -34,7 +34,6 @@ The company initially began by developing and publishing games for home computer # Hardware ## Game Genie - Game Genie was a series of video game enhancement devices developed by Codemasters and distributed by Galoob (later acquired by Hasbro). It was first released in 1990 for various gaming consoles, including the Nintendo Entertainment System (NES), Sega Genesis/Mega Drive, Super Nintendo Entertainment System (SNES), Game Boy, and Sega Game Gear. The Game Genie allowed players to input special codes, known as "cheat codes," which modified the behavior of games. These codes could enable features like unlimited lives, infinite ammunition, invincibility, and other gameplay enhancements that were not normally available in the game. Players could enter these codes through a simple interface before starting their game, and the effects would take place during gameplay. @@ -47,7 +46,6 @@ Sadly this was just the company Camerica jumping the gun to announce a product t --- # Software (Games) - Here is a list of the games codemasters are most famous for: * **Micro Machines** - NES, Sega Mega Drive/Genesis, Super NES, Game Boy, PlayStation, Microsoft Windows * **Colin McRae Rally** - PlayStation, Microsoft Windows, Game Boy Color, Game Boy Advance, PlayStation 2, Xbox, Nintendo DS, iOS, Android diff --git a/categories/companies/datel.md b/categories/companies/datel.md index e4b2d6b0..ac93acab 100644 --- a/categories/companies/datel.md +++ b/categories/companies/datel.md @@ -65,9 +65,9 @@ The Action Replay for the Super Nintendo wasn't just a cheat cartridge, it also ## Game Killer Before the Pro Action Replay was released for the N64 Datel decided to release a similar product but instead of allowing memory editing via cheat codes it had a few built in games and would write to the SRAM (Battery backed up save data inside the cartridge). So for example if you plugged in Mario 64 it would edit the save data to give you all the stars and 100% completion. -Not as useful as Action Replay as it pretty much completes the game for you, hence the name “Game Killer”. +Not as useful as Action Replay as it pretty much completes the game for you, hence the name "Game Killer". -One cool feature was that the cartridge has a card slot on it for “Killer cards” which were supposed to be cards that add support for other games but sadly none were ever released. This would be a cool reversing project to see if anyone can implement a working card for the Game Killer! +One cool feature was that the cartridge has a card slot on it for "Killer cards" which were supposed to be cards that add support for other games but sadly none were ever released. This would be a cool reversing project to see if anyone can implement a working card for the Game Killer! For more information on the Game Killer and the 6 in built games: http://www.nesworld.com/article.php?system=n64&data=n64-gamekiller @@ -162,10 +162,10 @@ The X-Port GBX allows you to upload and download saves from your GBA cartridges Of course they are most famous of their Action Replay (AR) cheat devices, which would have never have received approval from Sony. Modifying memory in the way AR does would be too much of a security risk in terms of piracy/exploits. ![PS2ActionReplayMax](https://user-images.githubusercontent.com/40120498/235313259-8880b0a6-d964-4158-9f42-c89c682ee723.jpeg) -However unlike cartridge based versions it didn’t have the Code Creation capability and thus you were reliant on the codes created by the “CodeJunkies” team. You could get these codes either on the website or use the #PS2 modem to connect to the servers, that was a nice touch! +However unlike cartridge based versions it didn't have the Code Creation capability and thus you were reliant on the codes created by the "CodeJunkies" team. You could get these codes either on the website or use the #PS2 modem to connect to the servers, that was a nice touch! ![ActionReplayMaxUpgrade](https://user-images.githubusercontent.com/40120498/235313286-cea79b7d-783f-46db-a699-3746c07250c4.jpeg) -But it didn’t stop there, the ability to print unofficial PS2 Discs was unique to Datel and thus they could sell products without giving a cut to Sony. So it was cheap for Datel to bring products to market, which allowed them to do cheaper per-game equivalents of Action Replay... +But it didn't stop there, the ability to print unofficial PS2 Discs was unique to Datel and thus they could sell products without giving a cut to Sony. So it was cheap for Datel to bring products to market, which allowed them to do cheaper per-game equivalents of Action Replay... Action Replay Soul Caliber There were many of these released for a third of the price of AR. However I believe the standard AR could do all the same cheats and would work out cheaper in the long run if you wanted to cheat in more than 3 games. @@ -177,7 +177,7 @@ One of the best examples is when they used their technology to add official team If you look at the Max Payne version, it is releasing the same day as the retail game which suggests Datel seem to have had early access to the final games before their release date. Other region versions wouldn't have all the same codes as they would have been recompiled... Action Replay Max Payne -One possibility is through their magazine subsidiary known as “Thin Ice Media” which published 3 retail magazines in the UK: GBX, G-force and PSi2. But would publishers really send preview copies to these magazines which were basically used as an advertising channel for Datel? +One possibility is through their magazine subsidiary known as "Thin Ice Media" which published 3 retail magazines in the UK: GBX, G-force and PSi2. But would publishers really send preview copies to these magazines which were basically used as an advertising channel for Datel? PSi2 Magazine Although to be fair their magazines went on to be fairly successful with PSi2 having at least 38 issues (not sure if issue 39 exists or not). You see they had one advantage over the competition: the ability to burn playable PS2 cheat discs... @@ -199,15 +199,15 @@ Side note: Action Replay was published by Karat in Japan and even had Potato Chi ![KaratActionReplayCrisps](https://user-images.githubusercontent.com/40120498/235313876-9408c00f-cfaa-47f9-8774-c13a6554ab85.jpeg) ## Karaoke Party -But they didn’t just create standalone subsets of Action Replay functionality they also made entirely new software such as Karaoke Party! Which came with very popular pop songs at the time. I wonder did they license the music but not the game? Or was it used without permission? +But they didn't just create standalone subsets of Action Replay functionality they also made entirely new software such as Karaoke Party! Which came with very popular pop songs at the time. I wonder did they license the music but not the game? Or was it used without permission? ![KaraokeParty](https://user-images.githubusercontent.com/40120498/235313914-ee6e7f37-e500-4a0d-b5db-ed288b626615.jpeg) ## Dance Master -In a similar vein comes Dance Master, which was basically just a Dance Mat accessory that can work with any PS2 dancing game, but unlike competitors Datel could include its own unlicensed “Dance Work Out Game” which must have given it an edge over other 3rd party Dance Mats. +In a similar vein comes Dance Master, which was basically just a Dance Mat accessory that can work with any PS2 dancing game, but unlike competitors Datel could include its own unlicensed "Dance Work Out Game" which must have given it an edge over other 3rd party Dance Mats. DanceMaster ## Eye Max -Another is eyeMax which builds of the craze that was the eyeToy and turns it into a video messaging service where you can create short video content to share with friends or the “global community”. It could have been the TikTok of its day, just a shame it wasn’t very well known... +Another is eyeMax which builds of the craze that was the eyeToy and turns it into a video messaging service where you can create short video content to share with friends or the "global community". It could have been the TikTok of its day, just a shame it wasn't very well known... eyeMax diff --git a/categories/consoles/3ds.md b/categories/consoles/3ds.md index 921ab0c8..e52f92a7 100644 --- a/categories/consoles/3ds.md +++ b/categories/consoles/3ds.md @@ -46,7 +46,6 @@ If you're interested in reverse engineering Nintendo 3DS software, it's essentia In this section of our guide, we will provide you with detailed information and resources on the hardware of the Nintendo 3DS, including retail, prototype, and development hardware. ## Retail Nintendo 3DS Hardware - If you're interested in learning more about the hardware architecture of the Nintendo 3DS, we highly recommend checking out the post on Copetti.org. This website is dedicated to exploring the technical details of the Nintendo 3DS hardware, including the CPU, GPU, and other components that make up the handheld console. You'll find in-depth explanations of how each component works, as well as detailed schematics and diagrams that help illustrate the inner workings of the Nintendo 3DS. {% include link-to-other-site.html url="https://www.copetti.org/writings/consoles/nintendo-3ds/" description="Copetti.org has an excellent tear down of the Nintendo 3DS Hardware and how it works" image="/public/consoles/Nintendo-3DS.png" title="Nintendo 3DS Architecture - A Practical Analysis" %} diff --git a/categories/consoles/Amiga.md b/categories/consoles/Amiga.md index b6ebae67..f10168fe 100644 --- a/categories/consoles/Amiga.md +++ b/categories/consoles/Amiga.md @@ -193,6 +193,7 @@ If you are interested to see officially released or leaked source code, for Amig It explores the clever optimization techniques, such as background caching with four frame buffers, which allowed the game to maintain a smooth frame rate despite drawing hundreds of polygons on a 7MHz processor [00:09:31]. The discussion also covers the game's virtual machine architecture that facilitated easy porting [00:11:29]. + ### The Polygons of Another World: A Retrospective on 90s Graphics Hardware Fabien Sanglard presents a comprehensive retrospective on the technical implementation of the 1991 game *Another World* (also known as *Out of This World*), focusing on how its vector-based graphics were rendered across various early 90s hardware platforms. The article series introduces the game's core architecture as a simple virtual machine (VM) with only 29 opcodes, 256 variables, 64 threads, and four framebuffers. This approach enabled high portability and resource efficiency. It delves into platform-specific optimization tricks, such as the use of background buffers and special palette manipulations for translucency effects. @@ -253,7 +254,7 @@ RobSmithDev has an excellent video about the history and reverse engineering of ### Essential Guide: The History of Trackers -[MusicTech](https://musictech.com/guides/essential-guide/history-of-trackers/) provides a comprehensive history of music trackers, starting with Karsten Obarski's *Ultimate Soundtracker* on the Amiga and evolving through the demoscene to PC tools like *FastTracker II* and *Impulse Tracker*. The article details the technical limitations that shaped the unique "tracker sound"—such as the vertical timeline and hexadecimal commands—and discusses their lasting legacy in modern production tools like *Renoise*. +[MusicTech](https://musictech.com/guides/essential-guide/history-of-trackers/) provides a comprehensive history of music trackers, starting with Karsten Obarski's *Ultimate Soundtracker* on the Amiga and evolving through the demoscene to PC tools like *FastTracker II* and *Impulse Tracker*. The article details the technical limitations that shaped the unique "tracker sound"-such as the vertical timeline and hexadecimal commands-and discusses their lasting legacy in modern production tools like *Renoise*. {% include link-to-other-site.html url="https://musictech.com/guides/essential-guide/history-of-trackers/" description="MusicTech chronicles the rise of music trackers, from the Amiga's 4-channel MOD format to the sophisticated multi-channel tools of the DOS era and their influence on modern DAWs." image="https://upload.wikimedia.org/wikipedia/commons/7/7b/Protracker_2.3a_screenshot.png" title="Essential Guide: History of Trackers" %} diff --git a/categories/consoles/Android.md b/categories/consoles/Android.md index f5a25734..e400d2a1 100644 --- a/categories/consoles/Android.md +++ b/categories/consoles/Android.md @@ -37,6 +37,7 @@ It operates automatically after decompilation to extract and analyze "magic stri {% include link-to-other-site.html url="https://github.com/0rShemesh/jadx-magic-strings" description="0rShemesh's JADX plugin automatically extracts source file references, method name candidates, and other structural information from string constants in decompiled Android code, aiding reverse engineering." image="https://opengraph.githubassets.com/1/0rShemesh/jadx-magic-strings" title="jadx-magic-strings: JADX plugin for extracting metadata from strings" %} ## Android File Formats + ### APK-Info: Full-Featured APK Parser (Rust/Python) The APK parser **apk-info** is designed for efficient forensic and security analysis, offering comprehensive extraction of crucial metadata from Android packages, including main activities, minimum SDK versions, and intricate details from the **AXML** (Binary XML) and **ARSC** (Resource) formats. Crucially, it fully supports parsing various **APK Signature Block 42** schemes (v1, v2, v3, v3.1), making it a powerful read-only utility for large-scale Android reverse engineering and malware analysis. diff --git a/categories/consoles/Arcade.md b/categories/consoles/Arcade.md index 072f3178..9c99d5b6 100644 --- a/categories/consoles/Arcade.md +++ b/categories/consoles/Arcade.md @@ -53,18 +53,18 @@ In the 1990 interview with **Mark Stephen Pierce** the following was published ( ## What did a Typical Arcade Game Development Team Look Like? -In the early days of arcade gaming, development teams needed to be highly specialized. Unlike today’s streamlined development environments, both **hardware and software** had to be built **from scratch** for each new game. This required expertise across a wide range of disciplines, from custom chip design to game logic and audiovisual presentation. +In the early days of arcade gaming, development teams needed to be highly specialized. Unlike today's streamlined development environments, both **hardware and software** had to be built **from scratch** for each new game. This required expertise across a wide range of disciplines, from custom chip design to game logic and audiovisual presentation. -As arcade hardware evolved and became more standardized—often borrowing from or influencing console architectures—the **hardware workload** decreased slightly. However, the **software and design** demands increased, calling for larger, more diverse teams to handle game mechanics, visual design, sound, and player experience. +As arcade hardware evolved and became more standardized-often borrowing from or influencing console architectures-the **hardware workload** decreased slightly. However, the **software and design** demands increased, calling for larger, more diverse teams to handle game mechanics, visual design, sound, and player experience. -A great example is Taito’s groundbreaking 1987 arcade title, **Darius**, which employed a team with clearly defined roles: -- **Sound Designer** – Yasuhiko Tanaka -- **Composer** – Hisayoshi “OGR” Ogura -- **Cabinet Designer** – Natsuki Hirosawa -- **Game Designer** – Junji Yarita -- **Planner** – Akira Fujita -- **Programmer** – Toru Sagawara -- **Hardware Engineer** – Takeki Nakamura +A great example is Taito's groundbreaking 1987 arcade title, **Darius**, which employed a team with clearly defined roles: +* **Sound Designer** – Yasuhiko Tanaka +* **Composer** – Hisayoshi "OGR" Ogura +* **Cabinet Designer** – Natsuki Hirosawa +* **Game Designer** – Junji Yarita +* **Planner** – Akira Fujita +* **Programmer** – Toru Sagawara +* **Hardware Engineer** – Takeki Nakamura For a deeper look into the development of *Darius*, check out this excellent translated interview on **shmuplations**: [Darius I & II – 1986/89 Developer Interviews – shmuplations.com](https://shmuplations.com/dariusii/) @@ -103,7 +103,7 @@ As for the software side, they had to write their own text editor and assembler, In Retro Gamer 28 there is an excellent article from **Archer Maclean** where he went to a presentation by **Eugene Jarvis** and this is what he had to say [^3]: > He went on to describe that his code spilled over into multiple files on more than one floppy, and yet there were no multi-floppy code-linkers so he devised the exact same bizarre jump vector solution I had devised to allow non-linked blocks of code to communicate. -> Then he described how he had to write ‘utilities’ to edit tiny bitmaps drawn on graph paper and entered as hex, +> Then he described how he had to write 'utilities' to edit tiny bitmaps drawn on graph paper and entered as hex, > and how to get around the one hour compile times by editing memory directly and disassembling in your head, > and how to make interesting sounds from 30 bytes of data, and how to write ultra-tight optimised machine code to move small bitmaps around a screen fast, and off course, cram it all into a 32k ROM. @@ -129,9 +129,9 @@ Speed-up kits, also known as **enhancement kits**, were aftermarket hardware mod ## Purpose and Impact of Speed Up Kits The primary motivations for implementing speed-up kits included: -- **Increased Revenue**: Faster gameplay reduced session times, allowing more players per hour and increasing coin drop rates. -- **Extended Cabinet Life**: By refreshing game mechanics, operators could delay purchasing new machines. -- **Enhanced Player Engagement**: New challenges and features kept experienced players interested. +* **Increased Revenue**: Faster gameplay reduced session times, allowing more players per hour and increasing coin drop rates. +* **Extended Cabinet Life**: By refreshing game mechanics, operators could delay purchasing new machines. +* **Enhanced Player Engagement**: New challenges and features kept experienced players interested. For example, the original **Asteroids** game allowed skilled players to play indefinitely on a single credit. A speed-up kit made the game more challenging, thereby reducing playtime per credit and increasing revenue . @@ -141,23 +141,23 @@ For example, the original **Asteroids** game allowed skilled players to play ind Some of the most famous examples of speed up kits are: -- **Super Missile Attack**: Developed by General Computer Corporation (GCC), this kit modified Atari's *Missile Command*, adding new enemies and increasing difficulty. Its success led to legal action from Atari, which was eventually settled when Atari hired GCC to develop games . -- **Ms Pac Man**: Another GCC project, this kit transformed Namco's **Pac-Man** into **Crazy Otto**, introducing new mazes and improved AI. Midway licensed and released it as an official sequel called **Ms Pac Man** [^6]. +* **Super Missile Attack**: Developed by General Computer Corporation (GCC), this kit modified Atari's *Missile Command*, adding new enemies and increasing difficulty. Its success led to legal action from Atari, which was eventually settled when Atari hired GCC to develop games . +* **Ms Pac Man**: Another GCC project, this kit transformed Namco's **Pac-Man** into **Crazy Otto**, introducing new mazes and improved AI. Midway licensed and released it as an official sequel called **Ms Pac Man** [^6]. --- ## How were Speed Up Kits implemented? Speed-up kits were typically implemented through reverse engineering the original game and modifying it using: -- **Daughterboards**: Additional circuit boards that modified signals or data paths. -- **ROM Replacements**: Swapping out original ROM chips with modified versions containing new code. -- **Clock Modifications**: Altering the system clock to increase CPU speed, thus speeding up gameplay . +* **Daughterboards**: Additional circuit boards that modified signals or data paths. +* **ROM Replacements**: Swapping out original ROM chips with modified versions containing new code. +* **Clock Modifications**: Altering the system clock to increase CPU speed, thus speeding up gameplay . --- ## Legal and Ethical Considerations While speed-up kits offered benefits to arcade operators, they raised legal and ethical questions: -- **Intellectual Property**: Modifying and distributing altered versions of games without permission infringed on the original developers' rights. -- **Quality Control**: Unauthorized modifications could lead to inconsistent gameplay experiences and potential hardware issues. +* **Intellectual Property**: Modifying and distributing altered versions of games without permission infringed on the original developers' rights. +* **Quality Control**: Unauthorized modifications could lead to inconsistent gameplay experiences and potential hardware issues. The legal dispute between Atari and GCC over **Super Missile Attack** highlighted these concerns. The settlement resulted in GCC ceasing unauthorized modifications and instead developing licensed content resulting in **Ms Pac Man** [^6]. @@ -165,9 +165,9 @@ The legal dispute between Atari and GCC over **Super Missile Attack** highlighte ## Legacy of Speed Up Kits Speed-up kits played a significant role in the arcade industry's evolution: -- **Innovation Catalyst**: They demonstrated the demand for game enhancements, influencing official sequels and updates. -- **Technical Advancement**: The reverse engineering skills developed during kit creation contributed to advancements in game development and hardware understanding. -- **Preservation Challenges**: Today, original speed-up kits are valuable to collectors and historians but pose challenges for preservation due to their unofficial nature. +* **Innovation Catalyst**: They demonstrated the demand for game enhancements, influencing official sequels and updates. +* **Technical Advancement**: The reverse engineering skills developed during kit creation contributed to advancements in game development and hardware understanding. +* **Preservation Challenges**: Today, original speed-up kits are valuable to collectors and historians but pose challenges for preservation due to their unofficial nature. --- @@ -206,7 +206,7 @@ JSMESS was created by cross-compiling the original C/C++ codebase into JavaScrip The original source code for JSMESS, is still available on [JSMESS original Github](https://github.com/jsmess/jsmess). But please note that it has now been integrated into the **main MAME repository**, so this repository is now **archived** and no longer actively maintained, but the source remains accessible for historical and reference purposes. -For an up-to-date build of JSMESS you can follow the Emscripten part of the guide here: [Compiling MAME — MAME Documentation 0.278 documentation](https://docs.mamedev.org/initialsetup/compilingmame.html#emscripten-javascript-and-html) +For an up-to-date build of JSMESS you can follow the Emscripten part of the guide here: [Compiling MAME - MAME Documentation 0.278 documentation](https://docs.mamedev.org/initialsetup/compilingmame.html#emscripten-javascript-and-html) --- ### 2015 - MAME merges with MESS @@ -228,8 +228,12 @@ MAME was again featured in EDGE magazine in **October 2002**, where it was descr # Unreleased Arcade Games ## Rare's Razz Board +The RAZZ is a 1988-era custom arcade board from Rare that used a unique Hitachi Z80-based "DMA hijacking" technique to enable high-speed sprite rendering and an extensive color palette, serving as the technical foundation for unreleased projects like the flight simulator 'Fokker' and the 'Playboy' handheld prototype. -[Rare Gamer - Fokker](https://www.raregamer.co.uk/games/fokker/) +### Fokker (Unreleased Arcade Game) +Rare Gamer provides a technical overview of Fokker, a cancelled 1988 arcade flight simulator that was intended to be Rare's first coin-op release. The link details the game's development on the proprietary "Razz" arcade board, which enabled 3D bi-plane dogfighting and bombing runs through early hardware-accelerated rendering techniques. Lead programmer Simon Hallam managed a five-month development cycle before the project was cancelled, leaving behind a functional prototype that serves as a significant milestone in Rare's early technical history. + +{% include link-to-other-site.html url="https://www.raregamer.co.uk/games/fokker/" description="Rare Gamer explores the history and technical implementation of Fokker, a cancelled 1988 arcade flight simulator that utilized Rare's custom Razz board." image="https://www.raregamer.co.uk/wp-content/uploads/2012/03/fokker_01.png" title="Fokker - Rare Gamer" %} --- # References diff --git a/categories/consoles/AtariJaguar.md b/categories/consoles/AtariJaguar.md index bec5283b..630b1183 100644 --- a/categories/consoles/AtariJaguar.md +++ b/categories/consoles/AtariJaguar.md @@ -50,7 +50,7 @@ The official "Atari Jaguar Development Manual" is available over on **archive.or It comes with: -* M68000 8-/16-/32-Bit Microprocessors User’s Manual Ninth Edition written by MOTOROLA in 1993 +* M68000 8-/16-/32-Bit Microprocessors User's Manual Ninth Edition written by MOTOROLA in 1993 * **ALN Linker** - 11 pages of linker documentation from 5th June 1995 * Appendix A - Frequently AskedQuestions About Jaguar * Appendix B - Programming Guidelines diff --git a/categories/consoles/DOS.md b/categories/consoles/DOS.md index 17a0e592..1a2d37c8 100644 --- a/categories/consoles/DOS.md +++ b/categories/consoles/DOS.md @@ -51,13 +51,13 @@ Unlike modern PCs it was fairly common to have Game ports (15-pin DA-15 connecto ## DOS-era Graphics Hardware For DOS games, the video card ports and expansion bus types evolved over time, with **ISA** dominating early DOS gaming through the 80s and early 90s. -Here’s a chronological overview of the common video card ports used for DOS gaming graphics and their associated buses: +Here's a chronological overview of the common video card ports used for DOS gaming graphics and their associated buses: -| Bus / Port Type | Time Period | Notes & Relation to DOS Gaming | -|---|---|---| -| **ISA (Industry Standard Architecture)** | 1981 to mid-1990s | The dominant bus for early DOS graphics cards like CGA, EGA, and VGA cards. ISA ran at 8 MHz (later 16-bit at 8-10 MHz) and was the standard for most DOS expansion cards initially. | -| **VESA Local Bus (VLB)** | Early 1990s (~1992 to 1994) | A 32-bit local bus designed to increase throughput for VGA/SVGA cards by connecting directly to the CPU bus at 33 MHz. VLB cards were used briefly in DOS gaming to allow faster graphics and higher resolutions. Mostly on 486 systems. | -| **PCI (Peripheral Component Interconnect)** | Mid 1990s onwards (from ~1993) | PCI replaced VLB and ISA for most expansions. PCI introduced a separate clock and 32-bit or 64-bit data width with higher throughput, becoming common in late DOS era and Windows 95 gaming. Many late DOS and early Windows 3.x/95 games used PCI graphics cards. | +Bus / Port Type | Time Period | Notes & Relation to DOS Gaming +---|---|--- +**ISA (Industry Standard Architecture)** | 1981 to mid-1990s | The dominant bus for early DOS graphics cards like CGA, EGA, and VGA cards. ISA ran at 8 MHz (later 16-bit at 8-10 MHz) and was the standard for most DOS expansion cards initially. +**VESA Local Bus (VLB)** | Early 1990s (~1992 to 1994) | A 32-bit local bus designed to increase throughput for VGA/SVGA cards by connecting directly to the CPU bus at 33 MHz. VLB cards were used briefly in DOS gaming to allow faster graphics and higher resolutions. Mostly on 486 systems. +**PCI (Peripheral Component Interconnect)** | Mid 1990s onwards (from ~1993) | PCI replaced VLB and ISA for most expansions. PCI introduced a separate clock and 32-bit or 64-bit data width with higher throughput, becoming common in late DOS era and Windows 95 gaming. Many late DOS and early Windows 3.x/95 games used PCI graphics cards. Here are what the ports looked like for anyone curious to build a retro PC using original hardware: diff --git a/categories/consoles/Dreamcast.md b/categories/consoles/Dreamcast.md index 11868b02..cecf1b21 100644 --- a/categories/consoles/Dreamcast.md +++ b/categories/consoles/Dreamcast.md @@ -21,6 +21,7 @@ redirect_from: tags: - dreamcast --- + # Introduction to Hacking/Reversing the SEGA Dreamcast Welcome to our page dedicated to SEGA Dreamcast reverse engineering! The SEGA Dreamcast was a beloved gaming console that was first released in 1998, and has since gained a cult following among retro gaming enthusiasts. @@ -42,7 +43,7 @@ So grab your VMU, fire up your Dreamcast, and get ready to dive into the excitin ### How the Dreamcast's Security was Hacked (MIL-CD) -This article debunks the common myth that the Dreamcast lacked security, explaining instead how the "MIL-CD" format—intended for interactive music albums—became the system's Achilles' heel. We detail how hackers exploited this oversight to bypass GD-ROM authenticity checks, allowing modified game ISOs to run on standard CD-Rs despite the console's built-in copy protection mechanisms. +This article debunks the common myth that the Dreamcast lacked security, explaining instead how the "MIL-CD" format-intended for interactive music albums-became the system's Achilles' heel. We detail how hackers exploited this oversight to bypass GD-ROM authenticity checks, allowing modified game ISOs to run on standard CD-Rs despite the console's built-in copy protection mechanisms. {% include_cached link-to-other-post.html post="/How-the-Dreamcast-Security-was-Hacked" %} @@ -106,7 +107,7 @@ Wikipedia maintains a list of Dreamcast exclusives - [Dreamcast-only games - Wi ## Reverse Engineering Ecco the Dolphin with Ghidra There is an excellent article by **Rings of Saturn** on reverse engineering Ecco the Dolphin for the Dreamcast, specifically how the cheat codes work via save names: -[Under the microscope: Ecco the Dolphin — Defender of the Future](https://32bits.substack.com/p/under-the-microscope-ecco-the-dolphin) +[Under the microscope: Ecco the Dolphin - Defender of the Future](https://32bits.substack.com/p/under-the-microscope-ecco-the-dolphin) ## Castlevania: Resurrection Dreamcast Reverse Engineering [Sega Dreamcast Info](https://www.sega-dreamcast-info-games-preservation.com/en/castlevania-dreamcast-reverse-engineering) provides a deep dive into the reverse engineering of the unreleased *Castlevania: Resurrection* E3 1999 prototype. The write-up details the discovery of plain text scripting for AI and level data, the extraction of hidden assets like music and textures, and the technical work required to create playable GDI and CDI images for modern hardware. diff --git a/categories/consoles/Game.com.md b/categories/consoles/Game.com.md index 266cff6a..21e02822 100644 --- a/categories/consoles/Game.com.md +++ b/categories/consoles/Game.com.md @@ -35,7 +35,6 @@ Welcome to our page dedicated to Tiger Game(dot)com reverse engineering! The Tig So grab your Game(dot)com and get ready to dive into the exciting world of Game com reverse engineering! --- - # Games ## Castlevania Symphony of the Night diff --git a/categories/consoles/GameBoy.md b/categories/consoles/GameBoy.md index b00fffb8..67915f71 100644 --- a/categories/consoles/GameBoy.md +++ b/categories/consoles/GameBoy.md @@ -28,6 +28,7 @@ redirect_from: tags: - gameboy --- + # Introduction Welcome to our page dedicated to Game Boy reverse engineering! The Game Boy was a groundbreaking handheld gaming console that was released in 1989, and has since become an iconic symbol of the early days of portable gaming. If you're interested in learning more about the technical aspects of this console and how it works, you've come to the right place. @@ -37,8 +38,8 @@ So grab your Game Boy and get ready to dive into the exciting world of Game Boy ## Original GameBoy Dot Matrix Game (DMG) Specs Main specs of the original GameBoy: - - **CPU**: z80 - LR35902 (Opcodes: http://www.pastraiser.com/cpu/gameboy/gameboy_opcodes.html) - - **RAM**: 8KB (32KB in Color) + * **CPU**: z80 - LR35902 (Opcodes: http://www.pastraiser.com/cpu/gameboy/gameboy_opcodes.html) + * **RAM**: 8KB (32KB in Color) ## Game Boy Exclusive Games (DMG & Color) When it comes to finding a game to reverse engineer, it can be helpful to look at games that are cross-platform to compare builds. But the most valuable reverse engineering projects tend to be the platform exclusives, as these are the games people can no longer play on modern consoles. @@ -78,7 +79,7 @@ The Pokemon Reverse Engineering Team (PRET) have managed to pull off a marvellou ## Legend of Zelda Links Awakening In August 2016 the website KZone started a full disassembly of the classic Game Boy game Link's Awakening, along the way they have written some excellent in-depth articles about how the game works. Check it out! -{% include link-to-other-site.html url="https://kemenaran.winosx.com/posts/category-disassembling-links-awakening/" description="Find out how Zelda Link's Awakening for Game Boy works at KZone!" image="https://kemenaran.winosx.com/images/zelda-links-awakening-sfx/LADX-move.gif" title="Disassembling Link’s Awakening" %} +{% include link-to-other-site.html url="https://kemenaran.winosx.com/posts/category-disassembling-links-awakening/" description="Find out how Zelda Link's Awakening for Game Boy works at KZone!" image="https://kemenaran.winosx.com/images/zelda-links-awakening-sfx/LADX-move.gif" title="Disassembling Link's Awakening" %} ## Looney Tunes: Carrot Crazy {% include link-to-other-site.html url="https://www.huderlem.com/blog/posts/carrot-crazy-1/" description="Find out how to reverse engineer Looney Tunes: Carrot Crazy for the GBC" image="https://www.huderlem.com/blog/posts/carrot-crazy-1/password-entry-screen.png" title="Reverse Engineering Carrot Crazy" %} @@ -142,8 +143,8 @@ To go along with the Game Boy Camera Nintendo also releases a Game Boy Printer t Similar to the Super GameBoy but this is for the Nintendo 64 and not licenced by Nintendo, I first saw this for sale in issue X of the UK Nintendo Official Magazine. For more information: -- http://www.chrismcovell.com/gbbooster.html -- https://gamehacking.org/wiki/Game_Booster_(Nintendo_64) +* [Chris Mcovell's page](http://www.chrismcovell.com/gbbooster.html) +* [GameHacking.org Wiki Page](https://gamehacking.org/wiki/Game_Booster_(Nintendo_64)) --- ## Datel Game Booster for Sony Playstation @@ -180,8 +181,8 @@ The Game Boy classic **R-Type** was programmed by **Jas Austin** completely from The company **B.I.T.S** obtained the license to develop the Game Boy version of the game but required a programmer to work on the title. **Jas Austin** heard about this through his agency and travelled to London to meet up, he impressed them so much that he was given a development kit and a deadline of a week to come up with a demo! He did such a good job he got a permanent job at **B.I.T.S** [^1]. -One cool easter egg he added to the game was an implementation of John Conway’s game of Life! - +One cool easter egg he added to the game was an implementation of John Conway's game of Life! + @@ -216,7 +217,7 @@ This is a very interesting project that played a large set of gameboy games in a {% include_cached link-to-other-post.html post="/game-boy-file-formats" description="For more about the game boy file formats information check out this post." %} ### DMG-palette-patcher -[MrBlinky](https://github.com/MrBlinky/DMG-palette-patcher) has released a Python tool for patching Original Game Boy (DMG) ROMs to use specific color palettes when played on a Game Boy Color. The script works by modifying the ROM's header—specifically the license code and title checksum—to trick the Game Boy Color's boot ROM into automatically selecting one of 45 built-in color palettes, such as the classic grey theme, rather than the default blue-greenish hues. +[MrBlinky](https://github.com/MrBlinky/DMG-palette-patcher) has released a Python tool for patching Original Game Boy (DMG) ROMs to use specific color palettes when played on a Game Boy Color. The script works by modifying the ROM's header-specifically the license code and title checksum-to trick the Game Boy Color's boot ROM into automatically selecting one of 45 built-in color palettes, such as the classic grey theme, rather than the default blue-greenish hues. {% include link-to-other-site.html url="https://github.com/MrBlinky/DMG-palette-patcher" description="MrBlinky has released DMG-palette-patcher, a tool that modifies Game Boy ROM headers to trigger specific built-in color palettes on the Game Boy Color." title="DMG-palette-patcher by MrBlinky" %} diff --git a/categories/consoles/GameBoyAdvance.md b/categories/consoles/GameBoyAdvance.md index 5054fe36..5f23e81d 100644 --- a/categories/consoles/GameBoyAdvance.md +++ b/categories/consoles/GameBoyAdvance.md @@ -84,7 +84,6 @@ Matt Greer's Blog has an excellent write up about reverse engineering the Ninten --- - # All Posts Tagged with GBA
diff --git a/categories/consoles/GameGear.md b/categories/consoles/GameGear.md index d4b2ec3e..659146b4 100644 --- a/categories/consoles/GameGear.md +++ b/categories/consoles/GameGear.md @@ -52,7 +52,7 @@ We know of two confirmed assemblers that were used for Game Gear programming: ## How was the final ROM built? Normally it was up to the main programmer to put everything together, all the images, sounds, music and other assets into the final game ROM that would be sent to Sega. -Developers such as **Paul Hutchinson** wrote programs with Turbo C++ to convert the asset data into assembler files (Define Byte (`.DB`), Define Word (`.DW`) etc statements) [^2]. Then an assembler is used to put everything together into a single file that can then be burned onto an EPROM using hardware such as **Needham’s Electronics EPROM programmer**. +Developers such as **Paul Hutchinson** wrote programs with Turbo C++ to convert the asset data into assembler files (Define Byte (`.DB`), Define Word (`.DW`) etc statements) [^2]. Then an assembler is used to put everything together into a single file that can then be burned onto an EPROM using hardware such as **Needham's Electronics EPROM programmer**. The EPROM was then inserted on to a development cartridge and tested on the retail system before finally sending to Sega via their Bullitin Board System (BBS) [^2]. diff --git a/categories/consoles/Gamecube.md b/categories/consoles/Gamecube.md index 5a27749e..5024d606 100644 --- a/categories/consoles/Gamecube.md +++ b/categories/consoles/Gamecube.md @@ -22,6 +22,7 @@ redirect_from: tags: - gamecube --- + Welcome to our page dedicated to Gamecube reverse engineering! The Gamecube was a popular gaming console released by Nintendo in 2001, and has since become a beloved classic of the gaming world. If you're interested in learning more about the technical aspects of this console and how it works, you've come to the right place. On this page, we've compiled a list of links to other pages that cover various topics related to Gamecube reverse engineering. Whether you're interested in understanding the hardware architecture of the console, analyzing game code, or exploring the many mods and hacks that have been created by enthusiasts over the years, you'll find a wealth of resources and information on the pages we've linked to. diff --git a/categories/consoles/MegaDrive.md b/categories/consoles/MegaDrive.md index 30757ab4..b5b7c211 100644 --- a/categories/consoles/MegaDrive.md +++ b/categories/consoles/MegaDrive.md @@ -57,7 +57,6 @@ There were many exclusive games for the Mega Drive and the various hardware add- --- - # Hardware If you're interested in reverse engineering software for the Sega Mega Drive gaming console, it's essential to have a strong understanding of the hardware that powers it. By comprehending the inner workings of the Mega Drive hardware, you can better understand how the software interacts with the hardware and how you can potentially modify or enhance it. @@ -104,7 +103,7 @@ The development of the game **Alien Soldier** and other games by **Treasure** ha ### How long did it take to develop games for the Mega Drive back in the day? At **Treasure** (e.g Alien Soldier) **Masato Maegawa** reveals that it takes around about 10 months but that more complicated games could last 2 years [^2]: -> In the Megadrive days we took about 10 months for a game; now it’s about 15 months. There were some titles that took us a full 2 years, though. +> In the Megadrive days we took about 10 months for a game; now it's about 15 months. There were some titles that took us a full 2 years, though. Although he also revealed that there was a tight development cycle for Alien Solider as the deadline was January 3rd 1995 and they were working through the New Year switch. ### What did a Mega Drive Design Document look like? @@ -123,9 +122,9 @@ It was common in the industry to develop custom software in-house to make the ga ### DARI and KETCHUP (Game Arts) For the development of the Mega Drive game **Alisia Dragoon**, Game Arts created some in-house development software called KETCHUP and DARI: -- **KETCHUP** was used for editing maps and defining the pattern of enemy movements by configuring basic curves in the editor, as can be seen in the image below [^3]. +* **KETCHUP** was used for editing maps and defining the pattern of enemy movements by configuring basic curves in the editor, as can be seen in the image below [^3]. ![KETCHUP Development Software](https://github.com/user-attachments/assets/da139574-dc3a-47b9-8590-efeda984bb39) -- **DARI** was used for editing animated Sprites for games targetting both Mega Drive and Sharp X68000 systems: +* **DARI** was used for editing animated Sprites for games targetting both Mega Drive and Sharp X68000 systems: ![DARI development software](https://github.com/user-attachments/assets/95868040-6b64-4ac3-b289-398d1fd50c30) diff --git a/categories/consoles/N64.md b/categories/consoles/N64.md index 6aae6fa8..e330680d 100644 --- a/categories/consoles/N64.md +++ b/categories/consoles/N64.md @@ -20,6 +20,7 @@ breadcrumbs: tags: - n64 --- + # Introduction to Hacking the Nintendo 64 Interested in learning more about the the N64? Excellent! This section will guide you through the basics, starting from basic MIPS assembly language all the way to an introduction to reverse engineering your first game! diff --git a/categories/consoles/Nes.md b/categories/consoles/Nes.md index ae873c3f..3eb76cea 100644 --- a/categories/consoles/Nes.md +++ b/categories/consoles/Nes.md @@ -27,6 +27,7 @@ tags: - nes - introduction --- + Welcome to our in-depth guide to Nintendo Entertainment System (NES) reverse engineering! This page serves two roles. It groups all of our posts related to reverse engineering for the system, and it aggregates high quality sources from the web into create a unified reference. The content starts high level, outlining the system, its history, and its official game development process, then moves into low level details with a focus on reverse engineering and homebrew development. diff --git a/categories/consoles/PC-88.md b/categories/consoles/PC-88.md index ea0e48c7..cd2ced9e 100644 --- a/categories/consoles/PC-88.md +++ b/categories/consoles/PC-88.md @@ -25,7 +25,6 @@ tags: > Not updated yet! Probably very wrong # Development of the PC-88 - ![NEC PC-8801 hardware](https://upload.wikimedia.org/wikipedia/commons/3/34/NEC_PC-8801MA2.jpg) ## What programming languages were used to create PC-88 software? @@ -34,7 +33,6 @@ tags: Commercial PC-88 titles were predominantly written in Z80 assembly for performance, particularly games relying on fast scrolling, sprite multiplexing, or timing-sensitive sound routines. BASIC (N88-BASIC), included with the system, served as an entry point for hobby development and some productivity software. Later PC-88MA models supported MS-DOS and high-level languages such as C, but commercial game development continued to rely mainly on assembly for deterministic control over the video and FM sound hardware. --- - ## What tools were used to create the art for PC-88 games? > Enix artist testing notes from 1987 reference "pixel boards" and "RGB preview rooms" where artists would repeatedly verify that PC-8801 palette constraints matched intended designs. @@ -46,14 +44,12 @@ Pixel art was often created on external workstations or specialized drawing tool Due to 8-color display limitations on early models, artists relied heavily on dithering, careful adjacency of palette indices, and structured shading patterns. Later VA models with 640x200 65-color modes broadened stylistic possibilities. --- - ## How long did it take to create typical PC-88 games? > In a 1992 retrospective, Hideo Kodama of Micro Cabin stated that the first Xak title was produced by "a team of five over roughly eight months", with the majority of engineering time spent on scrolling and text rendering systems. Small teams were common. Development cycles ranged from 3 to 12 months depending on genre and asset complexity. Studios developing adventure and visual novels often worked faster due to static screens, while RPGs or action games required extended tooling and engine creation. --- - ## Why was the PC-88 significant in Japanese game development? > According to a 2010 interview with Nihon Falcom founder Masayuki Kato, "the PC-88 was the proving ground for an entire generation of Japanese creators. Its limitations forced invention". @@ -67,7 +63,6 @@ The PC-88 became a pivotal platform for early Japanese PC game development due t Major franchises such as Ys, Dragon Slayer, Sorcerian, Policenauts, and early visual novels established templates that influenced later PC and console ecosystems. --- - # PC-88 Hardware Details ## Video hardware and graphics pipeline @@ -76,7 +71,6 @@ Major franchises such as Ys, Dragon Slayer, Sorcerian, Policenauts, and early vi The earliest PC-8801 models used a planar graphics system with 640x200 resolution and an 8-color fixed palette derived from RGB combinations. There was no hardware sprite engine; all animation was achieved through software blitting, often optimized with handwritten Z80 routines. Later VA models expanded to a 65-color palette and supported hardware scrolling. --- - ## Audio hardware > Composer Yuzo Koshiro recalled that programming the YM2203 for Ys required "writing long sequences of register values by hand" before later upgrading to macro-based sound drivers. @@ -88,7 +82,6 @@ Audio configuration varied by model: FM-supported models became essential for studios producing music-heavy RPGs and action titles. --- - ## Storage and media The system supported: * 5.25-inch floppy disks (common distribution medium) @@ -96,7 +89,6 @@ The system supported: * Hard disk options on later MA systems running MS-DOS --- - # Game Development at Falcom ## Internal workflow and tools @@ -111,7 +103,6 @@ Falcom pioneered efficient reuse of subsystems across titles. Their structure ar They maintained custom assemblers, map editors, FM music drivers, and debugging tools for rapid iteration. --- - # PC-88 Source Code ## Ys I (1987 by Nihon Falcom) @@ -124,7 +115,6 @@ Partial source materials, including disassemblies and fan analyses of sound driv Early assets and test scripts from the uncompleted PC-88 version circulate among preservation groups, offering insight into adventure-engine architecture designed for NEC platforms. --- - # References [^1]: Interview with Masayuki Kato, Falcom Journal (1985) [^2]: Enix Artist Notes, internal documentation (1987) diff --git a/categories/consoles/PC-engine.md b/categories/consoles/PC-engine.md index a471c79c..3a53aed7 100644 --- a/categories/consoles/PC-engine.md +++ b/categories/consoles/PC-engine.md @@ -18,9 +18,9 @@ recommend: - introduction _updatedAt: '2025-02-15' --- -# Introduction to the PC-Engine -Sakharu Baguette has created an excellent documentary which explores the history of the PC Engine (known as the TurboGrafx-16 in North America), detailing its rise as a major rival to Nintendo in Japan and its struggle to find footing in the US [^1]. +# Introduction to the PC-Engine +**Sakharu Baguette** has created an excellent documentary which explores the history of the PC Engine (known as the TurboGrafx-16 in North America), detailing its rise as a major rival to Nintendo in Japan and its struggle to find footing in the US [^1]. diff --git a/categories/consoles/PS2.md b/categories/consoles/PS2.md index eadfc41b..097c7dd6 100644 --- a/categories/consoles/PS2.md +++ b/categories/consoles/PS2.md @@ -46,18 +46,18 @@ For an in-depth look at the PlayStation 2 Retail hardware architecture check out ### What were the specs of the PS2? Display Specs: - - Supports 480p progressive - - MPEG-2 Full Motion Video (FMV) + * Supports 480p progressive + * MPEG-2 Full Motion Video (FMV) Sound Specs: -- Dolby pro logic 2 (5.1 Surround sound) -- DTS -- Streaming Audio +* Dolby pro logic 2 (5.1 Surround sound) +* DTS +* Streaming Audio Max Game Specs Per frame: - - 120,000 and 6,000 tris - - 3Mb of Textures - - Frame rate of 30 or 60fps + * 120,000 and 6,000 tris + * 3Mb of Textures + * Frame rate of 30 or 60fps ### Emotion Engine diff --git a/categories/consoles/PS4.md b/categories/consoles/PS4.md index fd5c78f2..913e689d 100644 --- a/categories/consoles/PS4.md +++ b/categories/consoles/PS4.md @@ -20,6 +20,7 @@ breadcrumbs: tags: - ps4 --- + # Introduction Welcome to our page dedicated to PS4 reverse engineering! The PlayStation 4 was a gaming console released by Sony in 2013, and has since become a beloved classic of the gaming world. If you're interested in learning more about the technical aspects of this console and how it works, you've come to the right place. diff --git a/categories/consoles/PSP.md b/categories/consoles/PSP.md index 4073964b..c95f153a 100644 --- a/categories/consoles/PSP.md +++ b/categories/consoles/PSP.md @@ -19,6 +19,7 @@ breadcrumbs: tags: - psp --- + # Introduction Welcome to our page dedicated to PSP reverse engineering! The PlayStation Portable, or PSP, was a popular handheld gaming console released by Sony in 2004. If you're interested in learning more about the technical aspects of this console and how it works, you've come to the right place. @@ -75,7 +76,7 @@ This section lists all the file formats that are useful to know about for revers On official PSP discs, there are actually two executables included in the **SYSDIR** folder: **BOOT.BIN** and **EBOOT.BIN** the former is uncompressed/unencrypted and suitable for reverse engineering and the latter is the encrypted version that is loaded by the PSP retail firmware. * **BOOT.BIN** - uncompressed, unencrypted executable, typically used during development and debugging. -* **EBOOT.BIN** - encrypted, compressed version of the same executable. Sony’s encryption prevents casual tampering and reverse engineering. +* **EBOOT.BIN** - encrypted, compressed version of the same executable. Sony's encryption prevents casual tampering and reverse engineering. Sometimes the **BOOT.BIN** file is filled with zero bytes, this was more common with later PSP games, in which case you will need to decrypt **EBOOT.BIN** manually instead. @@ -88,7 +89,7 @@ Homebrew/custom firmware can be configured to load either, which is why **BOOT.B --- ## PSP Game File Formats Officially the PSP either used physical Universal Media Discs (UMD) or PBP files to distrubte games, but there are a variety of formats available for storing PSP games: -* **ISO** - The most common format for PSP game files, an ISO is a disc image containing all the game disc’s data, essentially a copy of the Universal Media Disc (UMD) used by the PSP console. +* **ISO** - The most common format for PSP game files, an ISO is a disc image containing all the game disc's data, essentially a copy of the Universal Media Disc (UMD) used by the PSP console. * **CSO** - A compressed version of an ISO file that reduces file size for storage and sharing but might result in slightly longer load times during gameplay. * **PBP** - Used for official PSP game files downloaded from the PlayStation Network, this format contains multiple compressed files such as the game executable, data, and media. * **CHD** - Another compressed and compact format supported by many PSP emulators. @@ -127,7 +128,7 @@ Tools like **UMDGen**, commonly used for creating and editing PSP UMD ISO files, --- ### PARAM.SFO -**PARAM.SFO** is a small but critical metadata file used by the PSP (and also PS3/PS4/PS5 with different schema). It’s stored in the root of the **PSP_GAME** folder and sometimes inside the **SYSDIR**/**UPDATE** folders too. +**PARAM.SFO** is a small but critical metadata file used by the PSP (and also PS3/PS4/PS5 with different schema). It's stored in the root of the **PSP_GAME** folder and sometimes inside the **SYSDIR**/**UPDATE** folders too. The purpose of the file is to **describes the game** (or update package) to the PSP system, so that the XMB had the data for displaying the game icon, title, version, and other details. It also tells the firmware what minimum system software version is required to run. @@ -141,7 +142,7 @@ Typical Fields (for a PSP game): * **REGION** - Sometimes embedded to limit compatibility. The PSP will **refuse to boot the game** if PARAM.SFO is missing or corrupted, so make sure that when modding or trimming ISOs, PARAM.SFO must stay intact in the root! -The update folder’s PARAM.SFO is only used if you try to run the included firmware updater. +The update folder's PARAM.SFO is only used if you try to run the included firmware updater. It can be edited (with tools like **PSP SFO Editor**) to spoof firmware requirements, useful for running older ISOs on newer/different firmware. @@ -171,7 +172,6 @@ An excellent way to start reverse engineering is to find games where the develop --- # Reverse Engineering PSP Games with Ghidra - First step is to find your **BOOT.BIN** file, normally in the **PSP_GAME/SYSDIR** folder of the extracted game ISO. If you only have an EBOOT.BIN file you will need to convert it to a BOOT.BIN with a tool such as **PRXDecrypter**. Since **BOOT.BIN** files are standard ELF executables compiled for the **MIPS R4000** (little-endian) instruction set you can import directly into Ghidra without any plugins! diff --git a/categories/consoles/PokemonMini.md b/categories/consoles/PokemonMini.md index af661c40..a7217373 100644 --- a/categories/consoles/PokemonMini.md +++ b/categories/consoles/PokemonMini.md @@ -131,6 +131,7 @@ The developer `Scylus` has created a brand new browser-based (javascript) Pokemo {% include link-to-other-site.html url="https://github.com/pokemon-mini/mindis2" description="Pokémon Mini ROM disassembler with support for the official S1C88 assembly language" title="mindis2 - Pokémon Mini ROM disassembler" image="http://www.retroreversing.com/public/consoles/PokemonMini.png" %} --- + # ROM Hacking Pokémon Mini games ## Tile and Sprite editing diff --git a/categories/consoles/Saturn.md b/categories/consoles/Saturn.md index dba2ef35..a8e604d9 100644 --- a/categories/consoles/Saturn.md +++ b/categories/consoles/Saturn.md @@ -41,13 +41,11 @@ When it comes to finding a game to reverse engineer it can be helpful to look at {% include_cached link-to-other-post.html post="/sega-saturn-exclusives" description="For a list of all the exclusive Sega Saturn games check out this post." %} ## Reverse Engineering the Password System in *The Lost World: Jurassic Park* - -In May 2025, reverse engineer Bo Bayles published an in-depth analysis of the password system used in the Sega Saturn version of *The Lost World: Jurassic Park*. By examining the game's code with Ghidra, Bayles uncovered previously undocumented cheat codes that unlock features such as invincibility, a stage select screen, and two hidden arcade galleries. These discoveries shed light on the game's internal mechanics and offer new ways to experience the title nearly three decades after its release. +In May 2025, reverse engineer **Bo Bayles** published an in-depth analysis of the password system used in the Sega Saturn version of *The Lost World: Jurassic Park*. By examining the game's code with Ghidra, Bayles uncovered previously undocumented cheat codes that unlock features such as invincibility, a stage select screen, and two hidden arcade galleries. These discoveries shed light on the game's internal mechanics and offer new ways to experience the title nearly three decades after its release. For a detailed breakdown of the password system and the newly discovered codes, refer to Bayles' full article: -> [Under the Microscope: The Lost World – Jurassic Park](https://32bits.substack.com/p/under-the-microscope-the-lost-world) - +{% include_cached link-to-other-site.html url="https://32bits.substack.com/p/under-the-microscope-the-lost-world" description="Bo Bayles provides a comprehensive look at cracking the password encryption in The Lost World: Jurassic Park, revealing secret debug menus and arcade asset galleries hidden for nearly 30 years." title="Under the Microscope: The Lost World – Jurassic Park" %} ## Sega Saturn Graphics There are some myths around the Sega Saturn's graphical abilities, such as the lack of transparency support, that can be proven false with some clever programming techniques. diff --git a/categories/consoles/SuperNintendo.md b/categories/consoles/SuperNintendo.md index 2e23b737..040453a6 100644 --- a/categories/consoles/SuperNintendo.md +++ b/categories/consoles/SuperNintendo.md @@ -21,6 +21,7 @@ tags: - snes updatedAt: '2025-12-07' --- + # Introduction Welcome to our page dedicated to Super Nintendo reverse engineering! The Super Nintendo Entertainment System, or SNES, was a popular gaming console released by Nintendo in 1990. If you're interested in learning more about the technical aspects of this console and how it works, you've come to the right place. @@ -38,9 +39,9 @@ Most game development teams only had a handful of people working full time on th Some examples of the length of time it took to develop Super Nintendo games are: * **Spider Man & X-Men in Arcade's revenge** - Took roughly 6-7 months from start to final build using a team of 4 highly experienced game programmers, 2 talented musicians and 6 brilliant artists[^1]: - - Programmers: Mike Follin, Kevin Edwards, Stephen Ruddy and Michael Webb - - Artwork: Anthony Anderson, Craig Houston, David McLachlan, James Clarke, Jonathan M. Smith and Ste Pickford - - Music: Geoff Follin and Tim Follin + * Programmers: Mike Follin, Kevin Edwards, Stephen Ruddy and Michael Webb + * Artwork: Anthony Anderson, Craig Houston, David McLachlan, James Clarke, Jonathan M. Smith and Ste Pickford + * Music: Geoff Follin and Tim Follin * **Super Mario World 2: Yoshi's Island** - Took exactly 3 years and 5 months to complete (February 1st, 1992 until June 29th 1995 [^2]) with a team of 12 programmers. * **RPM Racing (Interplay)** - In an interview with SuperPro (October 1992) **Brian Fargo** explains that they only had **4-5 months** to implement the game after finding out the specs of the Super Nintendo. But he goes on to say that games after that took **1-3 years** on average to get a better level of polish. It was developed with the **Sluggo III** SNES development kit [^4]. @@ -111,7 +112,6 @@ However looking closely at the keyboard and the PC we can see its a **Sony NEWS* --- ## ROM and RAM Mapping on the SNES - The Super Nintendo (SNES) features a **24-bit address space** split into 256 banks of **64KB** each. However, only select banks are addressable via the SNES's CPU at any given time, necessitating careful mapping of ROM, RAM, and I/O registers. @@ -136,26 +136,25 @@ The [Tale of LoROM and MMIO Emudev article](https://emudev.de/q00-snes/memory-ma The ROM header is used to convey metadata about the cartridge, including its memory mapping configuration, it is essential for proper ROM emulation but ignored on the SNES hardware itself. It is typically just before the interrupt vector table but its physical location within the ROM file varies based on the memory mapping mode: -- **LoROM**: Header at offset 0x7FC0 in the ROM file. -- **HiROM**: Header at offset 0xFFC0 in the ROM file. -- **ExHiROM**: Header at offset 0x40FFC0 in the ROM file. +* **LoROM**: Header at offset 0x7FC0 in the ROM file. +* **HiROM**: Header at offset 0xFFC0 in the ROM file. +* **ExHiROM**: Header at offset 0x40FFC0 in the ROM file. These mappings align the header to $00:FFC0 in the SNES memory map, ensuring consistent access across different ROM configurations[^11]. #### What is the format of the ROM Header? - The ROM header comprises several fields that define the cartridge's characteristics: -- **0xFFC0–0xFFD4**: Game Title (21 bytes, ASCII) -- **0xFFD5**: ROM Speed and Mapping Mode (e.g speeds: 2.68 MHz/3.58 MHz, modes: LoROM/HiROM) -- **0xFFD6**: Cartridge Type (e.g., presence of coprocessors, SRAM) -- **0xFFD7**: ROM Size (encoded as 2^n KB) -- **0xFFD8**: SRAM Size (encoded as 2^n KB) -- **0xFFD9**: Region Code (e.g., NTSC, PAL) -- **0xFFDA**: Developer ID -- **0xFFDB**: ROM Version -- **0xFFDC–0xFFDD**: Checksum Complement -- **0xFFDE–0xFFDF**: Checksum +* **0xFFC0–0xFFD4**: Game Title (21 bytes, ASCII) +* **0xFFD5**: ROM Speed and Mapping Mode (e.g speeds: 2.68 MHz/3.58 MHz, modes: LoROM/HiROM) +* **0xFFD6**: Cartridge Type (e.g., presence of coprocessors, SRAM) +* **0xFFD7**: ROM Size (encoded as 2^n KB) +* **0xFFD8**: SRAM Size (encoded as 2^n KB) +* **0xFFD9**: Region Code (e.g., NTSC, PAL) +* **0xFFDA**: Developer ID +* **0xFFDB**: ROM Version +* **0xFFDC–0xFFDD**: Checksum Complement +* **0xFFDE–0xFFDF**: Checksum @@ -186,7 +184,7 @@ For an in-depth look at the SNES Retail hardware architecture check out the exce ### Was the SNES backwards compatible with the NES? No, but it was intended to be during early development of the SNES which we found out thanks to an interview with **Masayuki Uemura** [^8]: -> In truth, we actually wanted the Super Famicom to be able to play Famicom games too. We used a CPU that’s equipped with a 6502 emulation mode and everything. However, the sheer amount of games released for the Famicom, plus the fact that they often used different types of ROMs and chips made it too difficult to produce a perfect conversion. +> In truth, we actually wanted the Super Famicom to be able to play Famicom games too. We used a CPU that's equipped with a 6502 emulation mode and everything. However, the sheer amount of games released for the Famicom, plus the fact that they often used different types of ROMs and chips made it too difficult to produce a perfect conversion. --- ## SNES in-flight Airplane hardware (Nintendo Gateway) @@ -207,8 +205,8 @@ Also if you prefer video-based content the youtuber **Top Hat Gaming Man** has c In 2020 Luigiblood did a presentation to the **AirGap2020** conference about **Satellaview Reverse Engineering** which can be watched below: -### BS-X Cartridges +### BS-X Cartridges The **Satellaview** has little Memory Packs with only 1MB (8 MegaBit) of flash storage space that would slot into the BS-X Satellaview cartridges, it was a cartridge that had a smaller cartridge slot on top. Note that there was one other game that supported these Memory Packs, it was a game creator called **RPG Maker**. The BS-X cartridge has that name because it was the entry point into the Broadcast Satellaview (BS) network, and the "X" signified the virtual town interface that users navigated. diff --git a/categories/consoles/Wii.md b/categories/consoles/Wii.md index fafbe6a1..46e1efd7 100644 --- a/categories/consoles/Wii.md +++ b/categories/consoles/Wii.md @@ -20,6 +20,7 @@ breadcrumbs: tags: - wii --- + # Introduction to Hacking the Nintendo Wii Welcome to our page dedicated to Wii reverse engineering! The Wii was a popular gaming console released by Nintendo in 2006, and it introduced several groundbreaking features to the gaming world, such as motion-based controls and online gameplay. If you're interested in learning more about the technical aspects of this console and how it works, you've come to the right place. diff --git a/categories/consoles/Windows.md b/categories/consoles/Windows.md index cc4c7214..c309fd9d 100644 --- a/categories/consoles/Windows.md +++ b/categories/consoles/Windows.md @@ -68,7 +68,7 @@ Windows has played a significant role in the world of PC gaming, offering a vast In the past, many classic video games were developed for and played on DOS-based PCs. With the introduction of the Windows operating system, gaming transitioned to a more user-friendly and graphical environment, but many DOS games continued to run using compatibility features provided by Windows. The Windows platform offers backward compatibility for DOS games, allowing enthusiasts to relive the nostalgia of classic titles from the DOS era. This compatibility, along with the vast library of modern Windows-based games, showcases the ongoing role of Windows as a versatile and enduring platform for gamers. - + ## Windows Executable File Formats (NE,LE and PE) We have separated out the information on Windows executable (exe) file formats into its own post: {% include_cached link-to-other-post.html post="/WindowsExecutables" description="For more information on Windows Executables check out this post." %} diff --git a/categories/consoles/Wonderswan.md b/categories/consoles/Wonderswan.md index 341148b5..990949e1 100644 --- a/categories/consoles/Wonderswan.md +++ b/categories/consoles/Wonderswan.md @@ -45,49 +45,49 @@ Their were 109 games released for the original Black and White Wonderswan and 91 ### Terrors series Unless you can read Japanese you will not get much out of the three Terrors games on the wonderswan, however **Tara A. Devlin** has uloaded and english read through of the complete games on youtube. They are excellent and well worth a watch: -- Terrors 01: [Ghost Inn](https://www.youtube.com/watch?v=vYsG_LdaIow) -- Terrors 02: [Dear Friend](https://www.youtube.com/watch?v=7YwvOPcN2Jw) -- Terrors 03: [The Tiny Haunted House](https://www.youtube.com/watch?v=XusAmjdHp_8) +* Terrors 01: [Ghost Inn](https://www.youtube.com/watch?v=vYsG_LdaIow) +* Terrors 02: [Dear Friend](https://www.youtube.com/watch?v=7YwvOPcN2Jw) +* Terrors 03: [The Tiny Haunted House](https://www.youtube.com/watch?v=XusAmjdHp_8) ### Ring Infinity ## B&W Games enjoyable without reading Japanese This is a list of the games you can enjoy without being able to read any Japanese: -- Buffers Evolution - Platformer Racing game -- Crazy Climber -- D's Garage 21 Koubo Game Tane o Maku Tori - Puzzle game -- Densha de Go! (Although it is hard to play without some basic japanese) - Train simulator -- Engacho!- Puzzle game -- Final Lap 2000 - Made-7 style Racing -- Fishing Freaks - Bass Rise - Fishing game -- Ganso Jajamaru-kun -- Glocal Hexcite -- GunPey - Puzzle game -- Kaze no Klonoa - Moonlight Museum -- Lode Runner -- Magical Drop -- Makai Mura -- Mingle Magnet -- Moero!! Pro Yakyuu Rookies -- Nice On - Golf Game -- Ou-chan no Oeka-ki Logic - Puzzle Game -- Pocket Fighter - Beat em up -- Puyo Puyo Tsuu - Puzzle game -- Puzzle Bobble - Puzzle game -- Rainbow Islands - Putty's Party -- Rockman & Fotre - Mirai Kara no Chousensha -- Sennou Millennium -- Shin Nihon Pro Wrestling -- Side Pocket - Pool game -- Sliter Link - Puzzle game -- Soccer Yarou! - Challenge the World - Football game -- Space Invaders -- Tare Panda no GunPey - Puzzle game -- Tekken Card Challenge -- Trump Collector - Bottom-Up - Card game -- Trump Collector 2 - Card game -- Turntablist - Rhythm game -- Umizuri ni ikou - Fishing game -- Wasabi Produce - Street Dancer - Rhythm game -- Wonder Stadium +* Buffers Evolution - Platformer Racing game +* Crazy Climber +* D's Garage 21 Koubo Game Tane o Maku Tori - Puzzle game +* Densha de Go! (Although it is hard to play without some basic japanese) - Train simulator +* Engacho!- Puzzle game +* Final Lap 2000 - Made-7 style Racing +* Fishing Freaks - Bass Rise - Fishing game +* Ganso Jajamaru-kun +* Glocal Hexcite +* GunPey - Puzzle game +* Kaze no Klonoa - Moonlight Museum +* Lode Runner +* Magical Drop +* Makai Mura +* Mingle Magnet +* Moero!! Pro Yakyuu Rookies +* Nice On - Golf Game +* Ou-chan no Oeka-ki Logic - Puzzle Game +* Pocket Fighter - Beat em up +* Puyo Puyo Tsuu - Puzzle game +* Puzzle Bobble - Puzzle game +* Rainbow Islands - Putty's Party +* Rockman & Fotre - Mirai Kara no Chousensha +* Sennou Millennium +* Shin Nihon Pro Wrestling +* Side Pocket - Pool game +* Sliter Link - Puzzle game +* Soccer Yarou! - Challenge the World - Football game +* Space Invaders +* Tare Panda no GunPey - Puzzle game +* Tekken Card Challenge +* Trump Collector - Bottom-Up - Card game +* Trump Collector 2 - Card game +* Turntablist - Rhythm game +* Umizuri ni ikou - Fishing game +* Wasabi Produce - Street Dancer - Rhythm game +* Wonder Stadium diff --git a/categories/consoles/Xbox.md b/categories/consoles/Xbox.md index dcb13a8f..07296820 100644 --- a/categories/consoles/Xbox.md +++ b/categories/consoles/Xbox.md @@ -32,7 +32,6 @@ So grab your Xbox controller, and get ready to dive into the exciting world of X # Games ## Exclusives - Wikipedia has a list of the games that are still exclusive to the original Microsoft Xbox - [Xbox-only games - Wikipedia](https://en.wikipedia.org/wiki/Category:Xbox-only_games) --- diff --git a/categories/consoles/ZXSpectrum.md b/categories/consoles/ZXSpectrum.md index 6488f44f..2b4e7f89 100644 --- a/categories/consoles/ZXSpectrum.md +++ b/categories/consoles/ZXSpectrum.md @@ -20,6 +20,7 @@ _updatedAt: '2025-05-17' tags: - zxspectrum --- + The Sinclair ZX Spectrum, launched in 1982, was a pivotal 8-bit home computer that democratized computing and game development in the UK. Its affordability and accessibility spurred a generation of bedroom coders and laid the groundwork for the British games industry. @@ -38,7 +39,6 @@ However, due to memory constraints, color information was stored separately in a --- ## Development Hardware - Professional developers often used cross-development setups. Code was written and assembled on systems like the Tandy TRS-80 Model III or IBM PCs running CP/M, then transferred to the Spectrum via custom hardware interfaces for testing. @@ -47,7 +47,6 @@ This approach allowed for faster development cycles compared to coding directly --- ## CPU - The Zilog Z80A is an 8-bit microprocessor with a comprehensive instruction set, including 158 instructions and several addressing modes. It features a set of general-purpose registers, alternate register sets, and specialized registers like the index registers IX and IY, which are particularly useful for advanced memory access patterns. @@ -56,7 +55,6 @@ It features a set of general-purpose registers, alternate register sets, and spe --- ## Sound Hardware - Early Spectrum models produced sound through a simple beeper, controlled by toggling bit 4 of port 0xFE. This method required precise timing and often monopolized the CPU during sound playback. @@ -67,14 +65,12 @@ Later models, like the Spectrum 128K, incorporated the AY-3-8912 sound chip, off # Reverse Engineering ## File Formats - ZX Spectrum software was commonly distributed on cassette tapes, with data stored in formats like **.TAP**, **.TZX**, and **.Z80**. These formats encapsulate the program code and are used by emulators and reverse engineering tools to analyze and run Spectrum software. --- ## Disassembling and Decompiling - Tools such as **SkoolKit** and **Spectrum Analyser** are instrumental in reverse engineering Spectrum games. **SkoolKit** allows for the disassembly of machine code into annotated, human-readable formats, facilitating the understanding of game logic and structure. @@ -94,14 +90,12 @@ He dives into the technical challenges of emulating the Z80 CPU instructions, me # Official Software Development ## How Long Did It Take to Develop a Game Back in the Day? - Development times varied widely, simple games could be developed in a few weeks by a single programmer, while more complex titles might take several months and involve small teams. The lack of sophisticated tools meant that much of the development involved low-level programming and manual testing. --- ## What Would You Need to Write ZX Spectrum Games? - Developers typically used cross-assemblers on more powerful computers to write and compile code, which was then transferred to the Spectrum for testing. Essential tools included a text editor, assembler, and hardware interface for loading code onto the Spectrum [^1]. @@ -120,17 +114,16 @@ The original Hex Loader, first published in **Your Spectrum** issue 8 (October 1 --- ## Was There an Official SDK? - In the modern sense of a comprehensive SDK (Software Development Kit) from the platform owner, no, Sinclair did not provide an official SDK for Spectrum game development in the early 1980s. Unlike a contemporary console (e.g., Nintendo or Sega) which might have licensed dev kits, the Spectrum was a open consumer product and developers were expected to use either the built-in BASIC or their own tools to create software. -The primary “official” documentation was the BASIC programming manual and later the Spectrum Technical Guide (which covered hardware specifics and ROM routines). Sinclair’s focus was on selling hardware; they relied on third-party software houses to produce games without much centralized support. +The primary "official" documentation was the BASIC programming manual and later the Spectrum Technical Guide (which covered hardware specifics and ROM routines). Sinclair's focus was on selling hardware; they relied on third-party software houses to produce games without much centralized support. ### Official Documentation ![ZXSpectrum+ User Guide](https://github.com/user-attachments/assets/5485d118-4e77-4c9d-a56f-1642265bf023) -That said, Sinclair did endorse or distribute certain development tools. Notably, Sinclair’s ZX Spectrum+ (and later models) were often bundled with documentation that included memory maps and assembly programming tips, acknowledging the shift toward machine code development. +That said, Sinclair did endorse or distribute certain development tools. Notably, Sinclair's ZX Spectrum+ (and later models) were often bundled with documentation that included memory maps and assembly programming tips, acknowledging the shift toward machine code development. ### Crystal toolkit ![Zeus Assembler](https://github.com/user-attachments/assets/eaa6a9e9-434f-4e99-b9f0-8d132114eea4) @@ -138,9 +131,9 @@ That said, Sinclair did endorse or distribute certain development tools. Notably There were also a few cassette-based products sold under the Sinclair brand that were essentially development utilities. For example, Sinclair licensed a range of programming tools from a company called Crystal Computing (later known as HiSoft). -These included an **assembler** (Zeus), **editor** and a **debugger** that were sometimes promoted in Sinclair literature. According to a post on stack exchange [^3], the Crystal toolkit could be loaded in parts (assembler and monitor separately) for a “comprehensive development system,” and these were sold in Sinclair-branded packages in addition to Crystal’s own retail versions. +These included an **assembler** (Zeus), **editor** and a **debugger** that were sometimes promoted in Sinclair literature. According to a post on stack exchange [^3], the Crystal toolkit could be loaded in parts (assembler and monitor separately) for a "comprehensive development system," and these were sold in Sinclair-branded packages in addition to Crystal's own retail versions. -So one could argue there was a quasi-official “Sinclair development kit” comprised of those specific assembler and monitor tapes. +So one could argue there was a quasi-official "Sinclair development kit" comprised of those specific assembler and monitor tapes. ### Was there any sound or graphics libraries? No, beyond assembling and debugging, there was no unified SDK that provided game engines or graphics/sound libraries from Sinclair. @@ -158,7 +151,6 @@ Each developer accumulated their own proprietary library of routines which for s --- ### How Large Were ZX Spectrum Game Development Teams? - Many early Spectrum games were developed by individuals or small teams, often working from home (so called Bedroom coders). As the industry matured, some companies formed larger teams, but even then, teams were modest in size compared to modern standards. This small-scale development fostered a culture of innovation and personal expression in game design. @@ -167,7 +159,6 @@ This small-scale development fostered a culture of innovation and personal expre # Games ## R-Type (1988) ZX Spectrum Port - The ZX Spectrum port of **R-Type** represents a pinnacle of technical ingenuity within the constraints of 8-bit hardware. Developed by Bob Pape, the game pushed the 48K Spectrum to its limits through cycle-accurate Z80 assembly and extensive memory optimization. @@ -180,7 +171,7 @@ Real-time debugging was achieved through on-screen memory and register introspec Audio was handled via the built-in beeper, using pulse-width modulation to simulate multiple sound channels, which was a significant technical feat on such limited hardware. -For a comprehensive breakdown of the development process and the technical strategies used, Bob Pape’s own retrospective memoir **It's Behind You** is available online: +For a comprehensive breakdown of the development process and the technical strategies used, Bob Pape's own retrospective memoir **It's Behind You** is available online: [https://www.bizzley.com](https://www.bizzley.com) ### Magical Drop 2 Port to ZX Spectrum: A Reverse Engineering Exercise diff --git a/categories/consoles/iOS.md b/categories/consoles/iOS.md index c5c9cbcb..9d5a9ef8 100644 --- a/categories/consoles/iOS.md +++ b/categories/consoles/iOS.md @@ -121,7 +121,7 @@ The best way to check for recommended iOS 5.x games is to check out the Bookazin {% include link-to-other-site.html url="https://frida.re/docs/ios/" description="The official Frida guide for iOS explains how to set up the environment on both jailbroken and non-jailbroken devices to perform dynamic instrumentation and function tracing." image="https://frida.re/img/logotype.svg" title="Frida: iOS Documentation" %} -### **friman**: Frida Version Management Tool +### friman: Frida Version Management Tool **Thelicato** has developed **friman**, a Python-based utility that simplifies the management of multiple Frida versions, which is necessary due to compatibility issues across different devices and target projects. The tool enables seamless installation, local tracking, and switching of versions, along with specific helpers for downloading `frida-gadget` and `frida-server` assets, including a convenience utility for pushing the server to Android devices. @@ -132,7 +132,7 @@ The tool enables seamless installation, local tracking, and switching of version ## File Formats ### QLCARFiles: Assets.car Viewer for macOS -The **cgnkrz** repository provides **QLCARFiles**, a native macOS application built for the static analysis and inspection of Apple's compiled **Assets.car** files from iOS and macOS applications. This tool is valuable for reverse engineering as it offers a graphical interface to browse and view all bundled assets—including images at multiple scales, colors, and embedded data—and allows for easy extraction to disk. The project explicitly credits and builds upon the technical reverse engineering work of Timac on the underlying `.car` file format. +The **cgnkrz** repository provides **QLCARFiles**, a native macOS application built for the static analysis and inspection of Apple's compiled **Assets.car** files from iOS and macOS applications. This tool is valuable for reverse engineering as it offers a graphical interface to browse and view all bundled assets-including images at multiple scales, colors, and embedded data-and allows for easy extraction to disk. The project explicitly credits and builds upon the technical reverse engineering work of Timac on the underlying `.car` file format. {% include link-to-other-site.html url="https://github.com/cgnkrz/QLCARFiles" description="cgnkrz's QLCARFiles is a native macOS application that enables reverse engineers to visually browse, view, and extract bundled assets (images, colors, data) from iOS and macOS Assets.car files." image="https://opengraph.githubassets.com/1/cgnkrz/QLCARFiles" title="QLCARFiles: A native macOS app to view, explore, and extract assets from .car files" %} diff --git a/categories/games/debugSymbols.md b/categories/games/DebugSymbolsInGames.md similarity index 99% rename from categories/games/debugSymbols.md rename to categories/games/DebugSymbolsInGames.md index e5ae86f2..3f3ce6d9 100644 --- a/categories/games/debugSymbols.md +++ b/categories/games/DebugSymbolsInGames.md @@ -13,7 +13,7 @@ redirect_from: - /games/symbols - /debugsymbols - /unstrippedbinaries -editlink: ../categories/games/debugSymbols.md +editlink: ../categories/games/DebugSymbolsInGames.md tags: - symbols - debug @@ -88,7 +88,6 @@ There has also been a number of Nintendo leaks, leaking the full source code for --- ## SEGA consoles - We have never been able to find any Sega Saturn games that actually have debug symbols left on the disc! Sega must have been a little more strict on game developers before the dreamcast, so if you do find any games with debug symbols then please let us know. ### Sega Dreamcast diff --git a/categories/games/GameEngines.md b/categories/games/GameEngines.md index 81f8725f..46d420bd 100644 --- a/categories/games/GameEngines.md +++ b/categories/games/GameEngines.md @@ -28,6 +28,7 @@ recommend: - sdk editlink: ../categories/games/GameEngines.md --- + # Introduction to Game Engines & Middleware Game Engines are the foundation in which games are built, they contain all the logic to be able to show graphics, play audio, compute input, etc. without having any of the game specific assets such as sprites or music files. @@ -38,8 +39,8 @@ So you can think of game engines as the combination of middleware. ## Who develops game engines? There are two types of game engines based on who developed them or rather who has access to them: - - In-house game engines - Only available to one game development studio. - - Retail game engine - Engines that are normally sold as a product and used by multiple game development studios. + * In-house game engines - Only available to one game development studio. + * Retail game engine - Engines that are normally sold as a product and used by multiple game development studios. ## How much did game engines cost? This really depends on the engine, it could have been anywhere between a licensing fee per game sold or a one time fee of thousands of dollars for console games. diff --git a/categories/games/Games.md b/categories/games/Games.md index 3f132517..180cc1e5 100644 --- a/categories/games/Games.md +++ b/categories/games/Games.md @@ -15,6 +15,7 @@ editlink: ../categories/games/Games.md tags: - games --- + This page collects all the posts that are related to reverse engineering a specific game rather than an entire console or platform. ## Decompiled Retail Console Games diff --git a/categories/misc/Bookazines.md b/categories/misc/Bookazines.md index de2a9807..f87c8754 100644 --- a/categories/misc/Bookazines.md +++ b/categories/misc/Bookazines.md @@ -18,6 +18,7 @@ tags: - books - industry --- + What do you call a product that collects articles from monthly magazines into a single yearly publication? The publishers came up with the term "Bookazine" to cover this concept of a very large magazine related to a specific topic. @@ -223,5 +224,5 @@ QUESTIONS AND ANSWERS 3 | Modelling dinosaurs and more! | QUESTIONS AND ANSWERS 4 | Includes a mech design masterclass | QUESTIONS AND ANSWERS 5 | Global illumination in C4D and more | QUESTIONS AND ANSWERS 6 | Includes how to create realistic materials | -PORTFOLIOS | The pro’s guide to building a better portfolio by Andrew Gordon | +PORTFOLIOS | The pro's guide to building a better portfolio by Andrew Gordon | PUT YOURSELF IN THE FRAME | Follow these tips to land your dream job by Ian Dean | diff --git a/categories/misc/Books.md b/categories/misc/Books.md index fcf5fd6c..30fce287 100644 --- a/categories/misc/Books.md +++ b/categories/misc/Books.md @@ -19,6 +19,7 @@ updatedAt: '2024-08-04' tags: - industry --- +