Introduction
Introduction Statistics Contact Development Disclaimer Help
Post AWxo4phN24kqWG86TY by [email protected]
More posts by [email protected]
Post #AWvl1x60NuKoPkfR2W by [email protected]
0 likes, 0 repeats
I love finding a function in a game that is literally justvoid func(const char*…
Post #AWvpR3TsBM7nH03Zzc by [email protected]
0 likes, 0 repeats
@foone is this the C++ version of my time honoured method of debugging python, …
Post #AWvpR3XlwrFBT5sh4S by [email protected]
0 likes, 0 repeats
@http_error_418 it's more like having a bunch of error printing that you tu…
Post #AWvpX1mRPwpDjjadIu by [email protected]
0 likes, 0 repeats
@foone I’m curious why you chose this game, and what your goal is (obviously …
Post #AWvpX1qLBRwbvpPkNk by [email protected]
0 likes, 0 repeats
@bnut This particular game, someone asked me to, so I'm looking into it to …
Post #AWvpbeS9Zi7wpvIz1k by [email protected]
0 likes, 0 repeats
found another one! this one is called 450 times in the codebasebut they didn&#3…
Post #AWvpfy7sND9F0dsZd2 by [email protected]
0 likes, 0 repeats
@foone And when you have all the string constant that are passed as argument yo…
Post #AWvpfyC87OYDDpryG8 by [email protected]
0 likes, 0 repeats
@Seiryn exactly.if (iVar9 == 0) { FUN_0046320e0("TEXTURE NOT LOADED!&qu…
Post #AWvprJVFEcYEUhDf9c by [email protected]
0 likes, 0 repeats
also found that a bunch of functions do this:if (DAT_006b4af0!=0){ if(param1 =…
Post #AWvpxUU5JsCAI0ce1I by [email protected]
0 likes, 0 repeats
so, there's a global boolean that says "log all invalid function argum…
Post #AWvq2ecf3LC5BH60oa by [email protected]
0 likes, 0 repeats
it also means I can quickly look up all 420 (blaze it) places that DAT_006b4af0…
Post #AWvqJ359sdg7fsF7I0 by [email protected]
0 likes, 0 repeats
hey look this function (PR_InitBumpMapDot3 aka PR_InitBump) calls itself by two…
Post #AWvqPn7lbs8KD0g6O8 by [email protected]
0 likes, 0 repeats
C:\\Engines\\New Engine\\Ring0\\Win32\\PRSDK\\src\\Core\\Surfaces\\PR_D3DTextur…
Post #AWvrUnKUNGXmFOZuwC by [email protected]
0 likes, 0 repeats
@foone Not necessarily? It could be inlining?
Post #AWvrUnP668EKTgjb7Y by [email protected]
0 likes, 0 repeats
@Seiryn Nah, the test is one block at the top of the function. inlining it woul…
Post #AWvre0ujEjoIz8vQCO by [email protected]
0 likes, 0 repeats
BTW, because it's always fun to mention this fact, it turns out this game (…
Post #AWvtLnfbwDxcbdISki by [email protected]
0 likes, 0 repeats
"%s is an abstract class and cannot be explicitly instanciated"NINETE…
Post #AWw3Q7vbYoN28QTnhQ by [email protected]
0 likes, 0 repeats
wow, this engine doesn't believe in alignment AT ALL.the structure for diff…
Post #AWw4J5rAxnnldacNwe by [email protected]
0 likes, 0 repeats
I have one copy of the SDK which might help me hack this, but it's a sharew…
Post #AWw4av6dflk5VXLpxY by [email protected]
0 likes, 0 repeats
ahh. they stuck it in a self extractor, and that got infected. the installer in…
Post #AWw5UlLZ90k5SMxds8 by [email protected]
0 likes, 0 repeats
VARIFY YOUR PASSWORD
Post #AWw76cTmf4tqufQ7hw by [email protected]
0 likes, 0 repeats
R0GrSystemInitialzieDeviceSPELLING IS HARD
Post #AWxOZcmKWN2YcLTI2K by [email protected]
0 likes, 0 repeats
okay this is really weird. The game stores user-created fashion designs as high…
Post #AWxOi7YNz41KNi05y4 by [email protected]
0 likes, 0 repeats
See, I overwrote Outfit1B.jpg with a cat. Now I have a Cat Skirt.
Post #AWxOpNW91rbrv4Pewy by [email protected]
0 likes, 0 repeats
but if I hit the edit button, it's back to the original version.Strange dec…
Post #AWxP1a9HtM7eZOXavA by [email protected]
0 likes, 0 repeats
now I want to design an outfit by making an image, jpeg compressing it a lot, t…
Post #AWxPYVkPHDXaTYbYdk by [email protected]
0 likes, 0 repeats
@foone sounds like a cache then?
Post #AWxPYVof1OwYgkaxGq by [email protected]
0 likes, 0 repeats
@gareth yeah, but a really low-res JPEG cache
Post #AWxPsqys2dNI7a4Pku by [email protected]
0 likes, 0 repeats
as a reverse engineer, there is nothing I love more than seeing this:int ivar3 …
Post #AWxQ2ES29GvFWHBPNI by [email protected]
0 likes, 0 repeats
@foone thumbnails maybe?
Post #AWxQ2EVvum2diN0WS8 by [email protected]
0 likes, 0 repeats
@gareth nope, they're reloaded as the actual textures used by the game
Post #AWxQQESVltRqUeqnho by [email protected]
0 likes, 0 repeats
Fun fact: You can alter the game resolution using the undocumented ini settings…
Post #AWxQYf3mkjQXJQIwHA by [email protected]
0 likes, 0 repeats
@foone as someone whose only "reverse engineering experience" so far …
Post #AWxQYf7gWEXvVW83M0 by [email protected]
0 likes, 0 repeats
@7331 go for it! but it's still real with java. This is just a different so…
Post #AWxQivzudNp6jsOLB2 by [email protected]
0 likes, 0 repeats
oh my godwhen you go into the edit screen, it loads 12 patterns.all 12 are name…
Post #AWxQpWIoZBMz4eNCHg by [email protected]
0 likes, 0 repeats
I guess these people REALLY failed at naming things
Post #AWxQpZNX85vWc9bVYW by [email protected]
0 likes, 0 repeats
that's for the 12 plain-color cloth textures.The next page has 12 more colo…
Post #AWxR2yAUH2FzGKtK5o by [email protected]
0 likes, 0 repeats
then they've got 10 digits, 26 letters, and 8 sporty icons. 44 in total.You…
Post #AWxRNN5xJ1GyMbV49g by [email protected]
0 likes, 0 repeats
oh hey I see now why they have the debug_mode global boolean turned off.this ga…
Post #AWxRVPo96UWX5s0OAq by [email protected]
0 likes, 0 repeats
"PR: (ERROR) PR_SelectTexture Parameter 1 is out of range (0 to 228). Valu…
Post #AWxRwKKlYziHw45zay by [email protected]
0 likes, 0 repeats
so they load 68 files named Patterns01.tga when you click the desk, but the fun…
Post #AWxS6FEJOYyN08o1Q0 by [email protected]
0 likes, 0 repeats
I'll set a breakpoint on PR_LoadPRO (the proprietary file format for this e…
Post #AWxSIVwv3gEWKZWNSi by [email protected]
0 likes, 0 repeats
this game is from 2004, not 1994
Post #AWxTcsCO92VF5A1pSq by [email protected]
0 likes, 0 repeats
@foone french developer?
Post #AWxTcsGdtDuDIM1E5w by [email protected]
0 likes, 0 repeats
@f4grx Thai, I believe
Post #AWxToUcVdTCzQfmr8i by [email protected]
0 likes, 0 repeats
@foone calling it now, the file contents are PNG, but the image data is nonsens…
Post #AWxToUglNebxdrmFlo by [email protected]
0 likes, 0 repeats
@emily AHHHHHHHHHHHHHHHHI already did my time with JPEGs-in-TIFF and still get …
Post #AWxWhE4f3QrbwrBIwq by [email protected]
0 likes, 0 repeats
@[email protected] ... why jpeg? PNG is fast enough, even on a wii, right? an…
Post #AWxWhE8uncGaA3AhZw by [email protected]
0 likes, 0 repeats
@sekoiatree This is a PC game, where it makes even less sense
Post #AWxWodxpCAieGrWL9k by [email protected]
0 likes, 0 repeats
I think they did finally figure out an engine name, based on these function nam…
Post #AWxX85K9h9ZUd4Egl6 by [email protected]
0 likes, 0 repeats
It's got a feature to upload your designs to the barbie website, and I thin…
Post #AWxXXbyFS7df7XA2t6 by [email protected]
0 likes, 0 repeats
@[email protected] maybe my instinct of "default to png" is a moder…
Post #AWxXXc2VCJ2dKj9RWC by [email protected]
0 likes, 0 repeats
@sekoiatree Nah, PNG would have made perfect sense back in 2004. The only major…
Post #AWxYe91LaPnbJaI17w by [email protected]
0 likes, 0 repeats
@foone No PR_LoadIFF, literally unusable
Post #AWxYe95FLuuzVg78Cm by [email protected]
0 likes, 0 repeats
@Taffer fun fact: the main data files for this game (which is my primary target…
Post #AWxYm1ZFBIsGW1tyiG by [email protected]
0 likes, 0 repeats
__stdcall my beloved. best x86 calling convention ever.how do we pass arguments…
Post #AWxZtPzuqgNmGXT1YO by [email protected]
0 likes, 0 repeats
actually I think Girl_One_Cheezy_Fashion is the username.The password is bfs~^a…
Post #AWxa9xnewMD3jdcitU by [email protected]
0 likes, 0 repeats
@foone Going back to the full path in your "pick a name" toot, maybe …
Post #AWxa9xsGfDtbxvmP4q by [email protected]
0 likes, 0 repeats
@nullcolaship my godit is!
Post #AWxaKMGepC3iW48yVE by [email protected]
0 likes, 0 repeats
ooh, fun fact: if the server responds with a 501 error, the game just hangs for…
Post #AWxaUX09lsmyhcHCt6 by [email protected]
0 likes, 0 repeats
I was wrong on both counts! I netcatted it, and it turns out "Girl_One_Che…
Post #AWxaesVAglT8HQiWiu by [email protected]
0 likes, 0 repeats
User-Agent: Barbie Fashion ShowIT'S INTERNET EXPLORER, STOP LYING TO THE WEB
Post #AWxb2rbdfdBwS6BBke by [email protected]
0 likes, 0 repeats
I hacked the EXE to upload to localhost. The game originally pointed at vvjpgxf…
Post #AWxb2uTwyfp9N7bagS by [email protected]
0 likes, 0 repeats
this is what it uploads, btw
Post #AWxcCF6pkuOzuFo5Dc by [email protected]
0 likes, 0 repeats
@foone did they really go through the trouble of rendering a jpeg in the game a…
Post #AWxcCFAjWPWO6LdCIS by [email protected]
0 likes, 0 repeats
@0xabad1dea @foone tbh this seems easier to me? then you only need to have one …
Post #AWxcrcsMITUnUQlkuG by [email protected]
0 likes, 0 repeats
@foone i dont suppose it's like the creature designs from spore where the &…
Post #AWxcrcxK01Svjp5ids by [email protected]
0 likes, 0 repeats
@Runner Nope. Way too small for that. They were clearly focusing on dial-up use…
Post #AWxd05Vpi6QIcbGgBU by [email protected]
0 likes, 0 repeats
I had to name the game-specific allocation and free functions, and this is a ba…
Post #AWxer8XZHb7BJZwHhI by [email protected]
0 likes, 0 repeats
@whitequark @0xabad1dea @foone trusting your user uploads is a no-go in compute…
Post #AWxer8csxpMta4QWzA by [email protected]
0 likes, 0 repeats
@janvenetor @whitequark @0xabad1dea they clearly assumed there was only a small…
Post #AWxfvL4miWD5J32lFY by [email protected]
0 likes, 0 repeats
@foone shouldn't that be new Barbie and delete Barbie? malloc is so C89
Post #AWxfvL9kQ4BDYRMizA by [email protected]
0 likes, 0 repeats
@cmouse you'd think, but no. This codebase is C++ but they're using mal…
Post #AWxnrZjP5RxlEWl7WS by [email protected]
0 likes, 0 repeats
yeah the bastard thing is loading "files" named like "E13841F5C_…
Post #AWxo4phN24kqWG86TY by [email protected]
0 likes, 0 repeats
ahh, fun. they are running python 2.2, which is prior to python having booleans…
Post #AWxoMYDEmeepV3U3aS by [email protected]
0 likes, 0 repeats
@foone prior to WHAT
Post #AWxoMYHUWq3niFTSDY by [email protected]
0 likes, 0 repeats
@syn @foone to this day python's bool inherits from int. they basically mov…
Post #AWxoaJPob0YXf4ve7M by [email protected]
0 likes, 0 repeats
@whitequark @syn @foone This is a gross oversimplification!It's actually &q…
Post #AWxorVwdGWCnRYTuGe by [email protected]
0 likes, 0 repeats
@syn it had the idea of c-style truthiness, so it sorta had booleans, but there…
Post #AWxrySGlczvFvzttOS by [email protected]
0 likes, 0 repeats
So they modified python 2.2's source so that load_module in import.c doesn&…
Post #AWxt1h2nFjDGa1TLhQ by [email protected]
0 likes, 0 repeats
and I can confirm (because I disassembled it) the sipEngine.bc is actually a .p…
Post #AWxvtd6oIdRnvACKaO by [email protected]
0 likes, 0 repeats
@foone .bc stands for barbie code obviously
Post #AWxvtdB42oqm8MBjDU by [email protected]
0 likes, 0 repeats
@endrift definitely
Post #AWxwREo5A0k8OZSnj6 by [email protected]
0 likes, 0 repeats
correction: it's not a .pyc file.it is marshalled python code.that's wh…
Post #AWxwwl2rLhb1MFPC2i by [email protected]
0 likes, 0 repeats
well I tried injecting some new python code and now it hangs on start
Post #AWxxX2vCMWNXE37qTo by [email protected]
0 likes, 0 repeats
fixed it. I now have code running inside their engine! mwahahaha
Post #AWxzte0RMa62WKTs1I by [email protected]
0 likes, 0 repeats
the next step is to figure out how to yoink all their datafiles and then decomp…
Post #AWy1RjPvqp256RDqIC by [email protected]
0 likes, 0 repeats
ah-ha! I found a lingering reference to Qt, and figured out that the "sipE…
Post #AWy1RjUtYN0DLpXo1o by [email protected]
0 likes, 0 repeats
better link:https://www.riverbankcomputing.com/software/sip/
Post #AWy2fhCJ06jSE74Sxs by [email protected]
0 likes, 0 repeats
why is this code checking to see if a python tuple has less than zero itemshow …
Post #AWy2fjqR9s1QR9rXnM by [email protected]
0 likes, 0 repeats
https://github.com/python/cpython/blob/7b3ed5b29fd33ecfdaedc3bb0b8f6c05ded68361…
Post #AWy2fkbaKZjgnNvCHg by [email protected]
0 likes, 0 repeats
python... python never changes
Post #AWy3B5b4KmossRcijg by [email protected]
0 likes, 0 repeats
@foone hold up is that why swig is called swig?
Post #AWy3B5fK4yDr5dc7Mm by [email protected]
0 likes, 0 repeats
@humulus the joke goes the other way: sip is newer than swig
Post #AWy6RrBvRklmz6Y9ya by [email protected]
0 likes, 0 repeats
I have successfully decompiled DesignSc.kar! it's a bunch of opaque methods…
Post #AWy6RuIlsl1odCmAYy by [email protected]
0 likes, 0 repeats
oh good lordthe .kar files are of INCONSISTENT ENDIANNESS
Post #AWy6Rv4d0pJF1dAO9o by [email protected]
0 likes, 0 repeats
they've got the file size stored at offset 4 and offset 16, both as 32bit i…
Post #AWy6RvoiFUAlKYjBzM by [email protected]
0 likes, 0 repeats
the file size is also at offset 40.sadly, it's just little endian again.I w…
Post #AWy6RwaDOsAbhsx81w by [email protected]
0 likes, 0 repeats
okay decompiled all the python scripts. nothing interesting in them. GlobalSc.k…
Post #AWyAIOCIHBQgGtSmHI by [email protected]
0 likes, 0 repeats
PRLib ENCRYPTS the list of filenames in its archives.The contents of the files …
Post #AWyAIQyvvJWauKEeMy by [email protected]
0 likes, 0 repeats
what a shame
Post #AWyYlaD75WSKpNIfBo by [email protected]
0 likes, 0 repeats
@whitequark @syn @foone So what you're saying is they're prepared for a…
Post #AWyYlaI4n4QT4lccvQ by [email protected]
0 likes, 0 repeats
@AT1ST @whitequark @syn that would be non-binary computing
Post #AWyYqathxeiyPFc3cW by [email protected]
0 likes, 0 repeats
@foone: Do the callers pass 440 useful char pointers?
Post #AWyYqaxxhq7wcRbSFc by [email protected]
0 likes, 0 repeats
@riley yes
Post #AWzRUHe2MBUznqeo8e by [email protected]
0 likes, 0 repeats
@foone this reminds me of something a bespoke profiling tool in the Amazon flav…
Post #AWzRUHie53BY28oUK0 by [email protected]
0 likes, 0 repeats
@kevingranade I'm surprised perl isn't using a union but I guess that m…
Post #AX1cJ2jAxvX0AHp6oK by [email protected]
0 likes, 0 repeats
@zens I didn't know it was a debate! I was just confused
Post #AX1newfFHxhTE5dCiG by [email protected]
0 likes, 0 repeats
@foone i'm sorry W H A T
Post #AX1newjr0pO1SNmstc by [email protected]
0 likes, 0 repeats
@amberage hey, could be worse, they could do true=0, false=1
Post #AX1qYuQ917VcOQNhIG by [email protected]
0 likes, 0 repeats
@foone @amberage wasn't there a bug at some point with regular python that …
Post #AX1qYuU2mcd0aWCoN6 by [email protected]
0 likes, 0 repeats
@ShadowJonathan @amberage kinda, yeah! it was less a bug and more of a design d…
Post #AX1sqCXT6iPFPtBEu0 by [email protected]
0 likes, 0 repeats
@ShadowJonathan @foone @amberageThat reminds me: the fact that bool is a subcla…
Post #AX1sqCbMsDWdbz0Lyq by [email protected]
0 likes, 0 repeats
@obfusk fun. never thought about that issue.
Post #AX2RwrD4IrnbgkY0mG by [email protected]
0 likes, 0 repeats
@foone tuple size is unsigned in cPython, so that can't be negative, maybe …
Post #AX2RwrI20Pljw8ryVs by [email protected]
0 likes, 0 repeats
@thorsummoner nah. It's still in python. It's a check for a non-tuple o…
Post #AX3s1m3rfFxv8RCwCW by [email protected]
0 likes, 0 repeats
started documenting some of this on my wiki:https://wiki.foone.org/w/Barbie_Fas…
Post #AX3tK5zSPLT86tRjjE by [email protected]
0 likes, 0 repeats
I am making some progress in parsing the KAR files. I can dump the texture list…
Post #AX3tQIiQ0bbFJXR47c by [email protected]
0 likes, 0 repeats
fun fact: it does a similar thing to Wheel of Fortune (2010, Wii) in that it do…
Post #AX3us14jHuI0fOeQ64 by [email protected]
0 likes, 0 repeats
annoyingly there may be more textures in the textures chunks than are in the ma…
Post #AX3xNqELLPNQCsS0rg by [email protected]
0 likes, 0 repeats
also annoyingly, I've tracked down where it loads the texture width/height,…
Post #AX3xTXNmKhfdUMa252 by [email protected]
0 likes, 0 repeats
you'd think "well obviously they did them in the order width then heig…
Post #AX3xsbS6L4UJLmYQZE by [email protected]
0 likes, 0 repeats
never assume you're reversing something written by someone who had any amou…
Post #AX3xyckQR1m96czpPk by [email protected]
0 likes, 0 repeats
oh fuck me I'm in directxI don't even know how to figure out what 6374A…
Post #AX3yfKWU4Q1F2Cq5Jo by [email protected]
0 likes, 0 repeats
ooh goody. this program has unicows support because it might need to run on win…
Post #AX3zDYgRvYqUnbp0SW by [email protected]
0 likes, 0 repeats
oh my godit's from 2004and it checks for the pentium floating point bug
Post #AX3zbqFEHtuYDIfX7I by [email protected]
0 likes, 0 repeats
it also has code to detect it, which has an interesting decompilation. See, it …
Post #AX3zbt9JULxfDovLoO by [email protected]
0 likes, 0 repeats
which is correct. this function SHOULD always return 0... assuming your process…
Post #AX40ablOk6vcxvgukS by [email protected]
0 likes, 0 repeats
so here's what it does:divides 4195835 by 3145727, then multiply the result…
Post #AX40fUZUuSRk6lSBlY by [email protected]
0 likes, 0 repeats
on a normal processor, the final result will be 0.0on a FDIV bug processor, the…
Post #AX40fXCv6rAYHbuhUW by [email protected]
0 likes, 0 repeats
so comparing against 1.0 doesn't make sense. I must have misread this code
Post #AX4BYgqby5nteNPxLM by [email protected]
0 likes, 0 repeats
Finally found a listing of the Direct3DDevice9 vtables so I can make some progr…
Post #AX4COBYFZVLDe4NsWW by [email protected]
0 likes, 0 repeats
so the answer to my question from 2 hours ago:6374AEC0 means IDirect3DDevice9::…
Post #AX4CTjjptR0X7cRzLE by [email protected]
0 likes, 0 repeats
and the width and height are in that order
Post #AX4LDFicdX7UyK65gm by [email protected]
0 likes, 0 repeats
@foone Tucows came before unicows. Next we'll have to get zerocows.
Post #AX4LDFmsNiWTBW5UJs by [email protected]
0 likes, 0 repeats
@MegaMichelle fun fact: as part of this project, I got the SDK to the engine it…
Post #AX4NCMLqgtIZA59BQ0 by [email protected]
0 likes, 0 repeats
made some serious progress:I extracted all the textures from the TxFm blocks.Th…
Post #AX4NehURgv9apXgMFc by [email protected]
0 likes, 0 repeats
@foone What format are they? S3TC?
Post #AX4NehYhR6YZ2jfksi by [email protected]
0 likes, 0 repeats
@cinebox completely uncompressed! either R5G6B5 or A8R8G8B8
Post #AX4SalqC4Zl0w7nfg8 by [email protected]
0 likes, 0 repeats
well I thought I might have found one of the dress patterns.NOPE! unless it&#39…
Post #AX4SkGGmJCOxuqlCka by [email protected]
0 likes, 0 repeats
ah-ha! it's one of the textures ued for stage 2, Pajama Theme
Post #AX4TU05qmelJ4DSWS8 by [email protected]
0 likes, 0 repeats
HEY LOOK SOME FABRIC PATTERNS!
Post #AX4VPm8muvVkXlwj1E by [email protected]
0 likes, 0 repeats
Partial extraction. I don't yet understand the metadata, but I manually poi…
Post #AX4VZIH0omeoo8Kcka by [email protected]
0 likes, 0 repeats
so I just need to do a bit more work on understanding how this file (KADynamic.…
Post #AXEOlKGIUiLyLqO2dc by [email protected]
0 likes, 0 repeats
okay improved extraction of KADynamic as I now understand TrFm chunks. Next ste…
You are viewing proxied material from pleroma.anduin.net. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.