{"id":22,"date":"2014-03-19T16:20:35","date_gmt":"2014-03-19T16:20:35","guid":{"rendered":"https:\/\/blogs.scummvm.org\/josejx\/?p=22"},"modified":"2022-05-21T16:23:56","modified_gmt":"2022-05-21T16:23:56","slug":"figuring-out-what-to-do","status":"publish","type":"post","link":"https:\/\/blogs.scummvm.org\/josejx\/2014\/03\/19\/figuring-out-what-to-do\/","title":{"rendered":"Figuring Out What to Do"},"content":{"rendered":"<p><i>Continued from\u00a0<a href=\"https:\/\/blogs.scummvm.org\/josejx\/2014\/03\/19\/introduction-unpacking-and-moving-in\/\">the previous entry<\/a><\/i><\/p>\n<p>In this post, I&#8217;ll show you what my work flow generally looks like for reverse engineering. In the past, I&#8217;ve worked on a few reverse engineering projects like the <a href=\"http:\/\/bcm-specs.sipsolutions.net\/\">Broadcom BCM43xx<\/a> and the <a href=\"http:\/\/josejx.net\/collie\/\">Collie SD Card<\/a> interface for Zaurus. In any reverse engineering project, the first thing to figure out is where to begin! For this post, I&#8217;ll take a stubbed function from the ResidualVM code, explain how to find the original implementation, figure out what it does and then re-implement it.<\/p>\n<p>After getting EMI running, I noticed that there were a lot of debug messages about stubbed functions in the console window.<\/p>\n<figure id=\"attachment_24\" aria-describedby=\"caption-attachment-24\" style=\"width: 670px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/blogs.scummvm.org\/josejx\/wp-content\/uploads\/sites\/23\/2014\/03\/Console.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-24\" src=\"https:\/\/blogs.scummvm.org\/josejx\/wp-content\/uploads\/sites\/23\/2014\/03\/Console.png\" alt=\"\" width=\"670\" height=\"395\" srcset=\"https:\/\/blogs.scummvm.org\/josejx\/wp-content\/uploads\/sites\/23\/2014\/03\/Console.png 670w, https:\/\/blogs.scummvm.org\/josejx\/wp-content\/uploads\/sites\/23\/2014\/03\/Console-300x177.png 300w\" sizes=\"auto, (max-width: 670px) 100vw, 670px\" \/><\/a><figcaption id=\"caption-attachment-24\" class=\"wp-caption-text\">Console window, filled with debug messages<\/figcaption><\/figure>\n<p>Picking one at random, I decided to look into the function <i>Lua_V2::SetActorLocalAlpha<\/i>, but first, I needed to do a little bit of research!<\/p>\n<p>Understanding what the structure of the program is before diving into the assembly is usually a good idea. From the documentation at the <a href=\"http:\/\/wiki.residualvm.org\/index.php\/Research_on_EFMI\">ResidualVM wiki<\/a>, I saw that <a href=\"http:\/\/www.lua.org\/\">Lua<\/a> was the scripting language running the game and that EMI&#8217;s engine was structurally similar to the one used in Grim Fandango. Let&#8217;s take a quick look at the source code for ResidualVM and investigate the structure some more.<\/p>\n<p>In <i><a href=\"https:\/\/github.com\/residualvm\/residualvm\/blob\/master\/engines\/grim\/emi\/lua_v2.h\">engines\/grim\/emi\/lua_v2.h<\/a><\/i> <i>(line 39)<\/i>, we can see the list of Lua script functions that the engine provides. The actual code that implements these functions can be found in the rest of the files in <i>engines\/grim\/emi\/<\/i>. Of note, the function we&#8217;re interested in, <i>SetActorLocalAlpha <\/i>can be found in <i><a href=\"https:\/\/github.com\/residualvm\/residualvm\/blob\/master\/engines\/grim\/emi\/lua_v2_actor.cpp\">engines\/grim\/emi\/lua_v2_actor.cpp<\/a><\/i> at line 38. Helpfully, this code is partially completed, waiting to be finished!<\/p>\n<p>So, to summarize what we have so far:<\/p>\n<ul>\n<li>We have identified the function we&#8217;d like to work on<\/li>\n<li>We have information about how the EMI engine was put together<\/li>\n<li>We have found where the implementation will go once we&#8217;ve written it, and some helpful information from the stub function.<\/li>\n<\/ul>\n<p>Next, we&#8217;ll take a look at the binary from the original version of EMI. I&#8217;ll be working with the patched version if you&#8217;d like to follow along.<\/p>\n<p>I like working with <a href=\"https:\/\/www.hex-rays.com\/products\/ida\/index.shtml\">IDA<\/a>, it&#8217;s a great reverse engineering tool! Luckily for poor students like me, a <a href=\"https:\/\/www.hex-rays.com\/products\/ida\/support\/download_freeware.shtml\">version of the tool<\/a> is provided for free for non-commercial use. While all of the features of later versions would be nice, including a native Linux build, this will do for now. If you&#8217;re not using windows, <a href=\"http:\/\/winehq.org\/\">Wine<\/a> can be used to run IDA with almost no issues.<\/p>\n<p>To begin with, I first checked to see if the function name we were interested in was in the executable at all. Some binaries are stripped or obfuscated, making this job a lot harder.<\/p>\n<ul>\n<li>strings Monkey4.exe\u00a0 | grep SetActorLocalAlpha<\/li>\n<\/ul>\n<p>This returned two instances:<\/p>\n<pre>SetActorLocalAlpha\r\nSetActorLocalAlpha: Actor isn't wearing any primitives!<\/pre>\n<p>This looked promising! I put the Monkey4.exe binary into IDA and let it process the file. Once this was complete, I searched for the text <i>SetActorLocalAlpha<\/i>. Lucky for us, there&#8217;s a jump table with the function name in ASCII, likely for the Lua scripting engine to convert the text into the actual function call. The entry for <i>SetActorLocalAlpha <\/i>is found at <i>0x004C06D8<\/i>, and points to a function call at <i>0x00413570<\/i>. We now have the entry point for the function we&#8217;re interested in!<\/p>\n<p><a href=\"https:\/\/blogs.scummvm.org\/josejx\/wp-content\/uploads\/sites\/23\/2014\/03\/IDA.png\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-25 size-large\" src=\"https:\/\/blogs.scummvm.org\/josejx\/wp-content\/uploads\/sites\/23\/2014\/03\/IDA-1024x628.png\" alt=\"\" width=\"580\" height=\"356\" srcset=\"https:\/\/blogs.scummvm.org\/josejx\/wp-content\/uploads\/sites\/23\/2014\/03\/IDA-1024x628.png 1024w, https:\/\/blogs.scummvm.org\/josejx\/wp-content\/uploads\/sites\/23\/2014\/03\/IDA-300x184.png 300w, https:\/\/blogs.scummvm.org\/josejx\/wp-content\/uploads\/sites\/23\/2014\/03\/IDA-768x471.png 768w, https:\/\/blogs.scummvm.org\/josejx\/wp-content\/uploads\/sites\/23\/2014\/03\/IDA-1536x942.png 1536w, https:\/\/blogs.scummvm.org\/josejx\/wp-content\/uploads\/sites\/23\/2014\/03\/IDA-1200x736.png 1200w, https:\/\/blogs.scummvm.org\/josejx\/wp-content\/uploads\/sites\/23\/2014\/03\/IDA.png 1600w\" sizes=\"auto, (max-width: 580px) 100vw, 580px\" \/><\/a> In the next post, we&#8217;ll investigate what can be learned from the Lua scripts that actually call this function and how it can be used to improve our code.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Continued from\u00a0the previous entry In this post, I&#8217;ll show you what my work flow generally looks like for reverse engineering. In the past, I&#8217;ve worked on a few reverse engineering projects like the Broadcom BCM43xx and the Collie SD Card interface for Zaurus. In any reverse engineering project, the first thing to figure out is [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-22","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/blogs.scummvm.org\/josejx\/wp-json\/wp\/v2\/posts\/22","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.scummvm.org\/josejx\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.scummvm.org\/josejx\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.scummvm.org\/josejx\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.scummvm.org\/josejx\/wp-json\/wp\/v2\/comments?post=22"}],"version-history":[{"count":3,"href":"https:\/\/blogs.scummvm.org\/josejx\/wp-json\/wp\/v2\/posts\/22\/revisions"}],"predecessor-version":[{"id":27,"href":"https:\/\/blogs.scummvm.org\/josejx\/wp-json\/wp\/v2\/posts\/22\/revisions\/27"}],"wp:attachment":[{"href":"https:\/\/blogs.scummvm.org\/josejx\/wp-json\/wp\/v2\/media?parent=22"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.scummvm.org\/josejx\/wp-json\/wp\/v2\/categories?post=22"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.scummvm.org\/josejx\/wp-json\/wp\/v2\/tags?post=22"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}