Using Ghidra and Python to reverse engineer Ecco the Dolphin

https://32bits.substack.com/p/under-the-microscope-ecco-the-dolphin

by bbayles • 2 years ago

458 112 2 years ago

32bits.substack.com

skibz• 2 years ago

I'd love to see footage of the underwater soccer cheat in action.

praptak2• 2 years ago

QQRIQ is a phonetic abbreviation of "kukuriku", which is the sound of the rooster in Hungarian and in several other languages (Polish "kukuryku", Hebrew " קוקוריקו" etc.). Makes wonder what the process for choosing the passwords was.

bt1a2• 2 years ago

could it be that the rooster/cockadoodledoo is something performed like clockwork in the morning, so the showing framedata also being tangential to time and clocks ? probably not

bbayles7• 2 years ago

The programmers for this game were in Budapest, so this is a good guess!

praptak2• 2 years ago

I didn't know that. The QQRIQ jumped out at me because of my Polish background, so I googled it and found it's international.

jylam• 2 years ago

Cocorico in french, very close :)

rzzzt2• 2 years ago

Kikeriki in German!

Y_Y• 2 years ago

See also: the town of Kakariko in Zelda which always has chickens

danparsonson2• 2 years ago

Wow I had no idea that was the origin of that name

mtlebe• 2 years ago

Also Gyugyu might be a reference to the Hungarian movie: "The Fifth Seal"

"Just imagine you are about to die, but you will be reincarnated in to one of two people; a slave or the rich master. The slave suffers under the master. He has his tongue and an eye removed and his wife and child are killed. He goes on living knowing he is a good person, as he never committed such appalling, sadistic acts on another like his master has done. The rich master has no moral qualms about it at all. He doesn't think what he did was wrong; the slave needed to be punished. You have the choice, whether to be a poor and righteous slave or be a rich and corrupt master."

Gyugyu is the name of the slave.

https://www.imdb.com/title/tt0075467

nubinetwork• 2 years ago

Gyu is also the Japanese word for beef.

black-adder• 2 years ago

Popely with a Hungarian "ly" was a giveaway too

bt1a2• 2 years ago

im curious about the process to find that initial buffer address - does that involve entering a few different strings and searching the memory snapshot for those byte patterns ?

bbayles7• 2 years ago

Yeah, exactly! I took a couple memory snapshots of the name "AAA" and then threw out all of the addresses that had values that didn't match the first snapshot. Then I changed it to "BBB" and threw out all the addresses that did match.

There's a program called Cheat Engine that can make this a point and click thing; that's usually how people find GameShark-style codes.

bitbasher• 2 years ago

Can we just take a moment to appreciate how incredibly odd the Ecco series is? For anyone that beat the games. You go from swimming in an ocean to flying with aliens. It's bizarre. Some people classify it as a horror game.

bbayles7• 2 years ago

It really is a game with a strange mix of aesthetics. Blue skies and bright colors in the early levels; suspense and dread and supernatural stuff in the later levels.

Another Ed Annunziata game called Three Dirty Dwarves is also stylistically unique.

nelup202• 2 years ago

My favorite aspect is the music, I regularly listen to the OST while working: https://youtu.be/tqMuvFEKCOk

I've played a decent amount (never finished it), but I never understood why people say it's a horror game?

bbayles7• 2 years ago

A friend of mine explained that there are overlapping phobias of water and deep dark spaces that this game triggers; he said it's unbearable to play the later levels.

deemster• 2 years ago

The name of the game probably comes from dolphins echolocation ability. Another explanation I like to entertain is that the name is a reference to John C Lilly. He was a scientist who believed in an alien organization called the Earth Coincidence Control Office or E.C.C.O. He also studied dolphin intelligence and communication. He gave dolphins LSD in an effort to communicate with them. John C Lilly is an interesting rabbit hole to go down.

djmips4• 2 years ago

Probably both

VyseofArcadia2• 2 years ago

Great read!

Do you have any resources on getting started with Dreamcast game reverse engineering? I've been wanting to do some things with Skies of Arcadia, and I've been hoping there exist techniques more systematic than "see what values change between memory snapshots".

bbayles7• 2 years ago

I've poked around a bit with that game! The main trick is to import the memory snapshot (various ways of dumping it to a file; people like Cheat Engine for this) into Ghidra.

Ghidra can analyze the SuperH processor machine code natively, so the auto analysis will turn up lots of functions.

coldpie2• 2 years ago

I've been hoping there exist techniques more systematic than "see what values change between memory snapshots".

FWIW this is pretty much the standard method for locating value locations in RAM. It actually works pretty well. Some emulators have tools built in for that, like Dolphin for example. Even old game hacking tools like the Gameshark for N64 used the technique, with an on-console UI. I don't know if any Dreamcast emulators have tools for it or not.

I wrote about the technique in Dolphin here (and the followup article is also about console game hacking with Ghidra): https://www.smokingonabike.com/2021/01/17/hacking-super-monk...

AdmiralAsshat• 2 years ago

Some emulators have tools built in for that, like Dolphin for example.

This was an advertised feature of some DS flashcarts back in the day, too. I can't remember if it was the R4, the DSTwo, or what...but I recall an example video for their "Make your own cheats!" feature, which involved playing something like Super Mario Bros, turning on the "Cheats Finder" feature, then grabbing a coin, and maybe doing it a few times. The manager would then figure out the value that's changing in memory (presumably the sector that stores your coin amount), create the "cheat", and then you would enable it and watch your coin value go up.

jasomill• 2 years ago

Incidentally, Skies of Arcadia Legends on Dolphin is fantastic:

https://www.youtube.com/playlist?list=PLwH1xJhcXG0dBlmWL_DTu...

djmips4• 2 years ago

And old skool 'trainer' tools on PC. Someone more familiar that myself could give better information but I remember trying them out in the early 2000s and remarking how they reminded me of GameShark for PC

j0hnyl2• 2 years ago

I wish there was more detail on "how" this was done as opposed to just the "what"

nostoc• 2 years ago

It's very much the "how", what were you looking for that's not explained in the blog post?

j0hnyl2• 2 years ago

--- By analyzing a memory snapshot from the flycast emulator, I found that the buffer at 8cfffb34 holds the visible portion of the initials you type in. But if you keep typing, the characters you put in before get pushed into the buffer at 8c3abf18.

After loading the memory snapshot into Ghidra, I found that the function at 8c0334d8 reads this buffer. It performs a transformation on the buffer and then checks whether the transformed value is a list of six special ones. ---

How?

qingcharles4• 2 years ago

When the original Ecco came out on the Megadrive (Genesis), I spent all my hard-earned money to buy it. That game is obscenely hard. I got frustrated, so I sat down for the afternoon with a pen and paper and somehow managed to decode the password system. I teleported to the final level and completed it the next day.

Then I was wracked with guilt about spending all my money on a game I completed in two days.

coldpie2• 2 years ago

I sat down for the afternoon with a pen and paper and somehow managed to decode the password system

Would love to hear more about this, if you have any recollection :)

qingcharles4• 2 years ago

I'd love to know how I did it. There must have been a certain element of luck. I actually found the decompiled routine for the password code a couple of years ago and, IIRC, it was surprisingly more sophisticated than my teenage brain would have suspected.

https://eccothedolphin.online/ecco-password-generator/

VyseofArcadia2• 2 years ago

What a final level, though! Having skipped a large chunk of the game, were you surprised by it?

qingcharles4• 2 years ago

LOL. I can't remember my reaction at the time. I'd only played through the first few "normal" levels before I got frustrated with the difficulty. I'm sure I was very confused :D

7bit• 2 years ago

You must be the only Person in the world that Beat this Game, cheating or otherwise.

egypturnash• 2 years ago

https://youtu.be/OGVUuVjXMTA ecco the dolphin any% speedrun world record [17:54]

which is actually faster than the 20:44 TAS! (https://tasvideos.org/228G)

dfxm122• 2 years ago

Philosophically, I would argue that you did not complete the game.

You skipped several levels and saw only some percentage of the intended content, gameplay, story, etc. Games in general, and Ecco the Dolphin is no exception, are very much about the journey and not just the destination. You missed out on themes & experiences like isolation, making friends with those outside of your in-group, conservation, time travel, communing with dinosaurs and, of course, space travel.

So, you really shouldn't have felt so guilty.

schrectacular• 2 years ago

I wonder if this will make him feel guilty for feeling guilty

nextlevelwizard6• 2 years ago

There are plenty of people who would argue that getting to end credits means beating the game.

You can however say that skipping levels also skips the story, so they did not finish the story.

snowram• 2 years ago

Does that mean that taking warp zones in Mario doesn't count as beating the game?

29athrowaway• 2 years ago

Is not this against the Ghidra EULA?

immibis• 2 years ago

In the real world, no one cares, unless they're on the receiving end of a lawsuit.

yjftsjthsd-h• 2 years ago

What EULA? It looks like https://github.com/NationalSecurityAgency/ghidra says it's Apache 2.0

saagarjha• 2 years ago

The one you get when you start it for the first time

ptek• 2 years ago

Is this not against the Ghidra EULA?

He's not trying to reverse engineer a serial or key file. It's being used for private use. He's not making $$$$ at SEGA's loss. It's not going to destroy SEGA's reputation.

and finally they are a hacker so the dopamine hit from being curious will be a big pay off.

nextlevelwizard6• 2 years ago

Even if he was, then what? Quick glance at the repo does not show any kind of End-User License and even if it had what's the NSA going to do? Revoke his license? Sue him?

nextlevelwizard6• 2 years ago

citation needed

mytaterskin• 2 years ago

I've taken to older games a lot more in recent years, they feel like they have a lot more soul if that makes any sense. Also sorry about your car! Not going to leave it idling in the driveway anymore, thanks for the warning.

bbkane• 2 years ago

Are you sure you don't miss modern features like mandatory network connectivity and micro transactions?

djmips4• 2 years ago

What happened to their car? I didn't see anything about that in the post or comments.

fanoto• 2 years ago

Nice! Interesting how similar games seem to do this, checksumming to fixed integers. Pitfall: The Lost Expedition did something very similar by converting button presses into ASCII-represented strings of the input buttons that were then CRC-ed. The approach was similar to just brute-force in Python and compare to the extracted cheat hashes.

I even spy your CRC32 table hidden in the `decrypted_ints` . The pre-generated tables are so easily searchable. It leaves me curious why they are so often found obfuscated in attempt to make it more difficult compared to generating a new one with your own polynomial.

jimmaswell• 2 years ago

The 3DS version was very cool. I plan on completing it there eventually. I wonder if those devs had source access.

SideQuark5• 2 years ago

The hash is merely a CRC32; exactly this one (polynomial 0x77073096, code is wrong)

https://web.mit.edu/freebsd/head/sys/libkern/crc32.c

(The decoded ints in the post are the constants in this CRC32).

Knowing it's a CRC32 and knowing the polynomial allows inverting the answers in log time instead of exponential time by exploiting the modular math of the polynomial rings.

byteknight• 2 years ago

I know some of these words!

Thaxll• 2 years ago

It means that using bruteforce to find all the values would be much faster.

bbayles7• 2 years ago

Thanks! I didn't clock that - should have looked at the decrypted values!

mirthflat83• 2 years ago

Do you have any tips on knowing how the value is a result of CRC32 and/or the polynomial/initial value used?

15155• 2 years ago

Looking in the binary for the polynomial and knowing what the common ones are from experience is an easy way.

Normally, the polynomial is going to be found right next to a loop that is ingesting bytes incrementally.

SideQuark5• 2 years ago

In this example, the "encrypted data" is xored with the key 4 bytes at a time. The first 4 bytes in the data are the same as the key. For the next 4 and you get the constant I posted above. Plug into Google, find where it is often found, decide rest of table, see it matches.

I've learned programmers either invent their own hashes, random number generators, and crypto, in which case I usually break them, or they reuse existing algos, in which any code constants are searchable.

Plus I've written and reversed enough of all that I recognized the loop as a CRC polynomial remainder loop.

All Crc-n algos are trivially crackable/reversible/collideable. They're a remainder on division of polynomials (learn the math on how they work), so use the polynomial equivalent of extended euclidean algo and you get one answer. Now all sufficient multiples of that mod class give all possible answers, one at a time.

That should give you plenty to chase through

TheAdamist• 2 years ago

Binwalk claims to recognize crc polynomial tables i wonder if it could find this one.

Also someone needs to integrate binwalk & ghidra, they synergize too much.

SideQuark5• 2 years ago

Binwalk wouldn't find it. The constants were xored with a value so they wouldn't show up in the binary

butz• 2 years ago

You should look into PS2 version of this game, it seems to have same code for level unlock. Maybe it will be easier to reverse engineer and figure out what all codes do?

Liquix• 2 years ago

an interesting aside: when asked about his inspirations Ecco's developer Ed Annunziata said, "No, I never took LSD, but I did read a lot from John C. Lilly". Lilly is known for his pioneering work in the fields of animal intelligence, ketamine psychotherapy, isolation tanks, and consciousness exploration.

The name "Ecco" is a reference to Lilly's ECCO (Earth Coincidence Control Office), a supernatural/extraterrestrial base which John posited existed on the other side of the moon to coordinate all earthly "coincidences". He was also one of the first to recognize how intelligent dolphins were and became obsessed with figuring out how to communicate with them, going as far as flooding half of his house in the Carribeans to cohabitate. This is just the tip of the iceberg. I'd highly recommend his autobiography The Center of the Cyclone if any of this is intriguing, he's a fascinating guy

n0id34• 2 years ago

I wish more people knew how to change to Ghidra's dark theme and change the font.

chungy• 2 years ago

Maybe the author likes it this way. People can have preferences that differ from your own.

Kon-Peki2• 2 years ago

Wow, a blog that focuses on the Sega Saturn!

Not too long ago, I found a Saturn in a closet at my parent’s house, along with a small handful of game CDs. I don’t have any recollection of owning one, so I’m guessing my little brother must have acquired it after I left for college. Anyway, I plugged it in and all the games worked! But other than that I have no idea what to do with it (obviously the trash is not an option).

wileydragonfly2• 2 years ago

The games are worth a fortune. I gave mine away in 2005 and now I get heart palpitations when I look them up on eBay.

Kon-Peki2• 2 years ago

Interesting. My son suggests getting a table at VCF next year and setting it up for people to play; perhaps I’ll do that and have a sign that says “make an offer”

BolexNOLA• 2 years ago

Have fun!

https://terraonion.com/en/producto/terraonion-mode/

pezezin2• 2 years ago

You also have

- The Satiator, that plugs into the video card slot so you can still use original CDs.

- The Saroo, that plugs into the cartridge slot, also emulates the RAM expansion carts, and it is much cheaper (but seems to have some compatibility problems).

wileydragonfly2• 2 years ago

Anyone else never beat the second level? Yes, we all eventually figured out that we had to jump over the rock wall… but after that… then what?

kadoban• 2 years ago

The next parts I vaguely remember: swim _very_ slow past an octopus arms (there's a hint but it's not necessarily clear that you have to be barely moving at all), hit key crystals and then the corresponding ~door crystals, and push a rock to drop and follow after them to avoid getting pushed back by the current.

It's generally a series of puzzles of that form and there's some ~light combat stuff.

heisenburgzero• 2 years ago

I always wondered where to start learning reverse-engineering. Most people will say learn Assembly first. But from there on, there seems to be not much more concrete information online.

Do people just figured it out by trial & error like common patterns in x86 / arm / arcade platforms slowly?

I can't really find much discussion on details online.

bbayles7• 2 years ago

I knew some from school, but stepping through a debugger with a video game that I remembered from childhood was a better education on computer engineering than anything I got in class.

fragmede• 2 years ago

run through http://microcorruption.com or https://crackmes.one/ for closer to real-life examples

djmips4• 2 years ago

It's like debugging.. I'm sure you must have worked on an unfamiliar code base at some point and had to figure it out. Instead of having the source you have the binary and using tools like Ghidra you can start to piece together the source but you'll still need to reason over it the very same way you did on that unfamiliar codebase and this time there's no comments at all ( which isn't uncommon in a lot of source available projects mind you )

So you're probably already half way there. Being familiar with assembly code helps of course.

etra0• 2 years ago

I personally learned a lot by messing in Cheat Engine, it is way more capable than I thought, specially because I mostly used it as a kid and never looked back.

It is a great tool to get started with assembly in my opinion because the disassembler is good enough and you can write what they call 'assembly scripts' which provides the foundation on doing memory patches in x86 asm. Then from that you can start writing your own utils to patch the games at your own will.

You can do crazy cheats by patching the game just with Cheat Engine!

Using Ghidra and Python to reverse engineer Ecco the Dolphin

Related Stories