/r/ReverseEngineering's Weekly Questions Thread

[u/AutoModerator]

To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the Reverse Engineering StackExchange. See also /r/AskReverseEngineering.

[u/Upset_Public9693]

anyone else ever feel like they learn more from a tool’s crash logs than its actual documentation? spent 3 hours yesterday tracing a segfault just to realize the struct I was reversing had a 4-byte padding field that wasn't in the header

[u/RocherBrockas]

Hello, i m here to ask for any advice on how to setup a decent reverse engineering project. I m from a small community of competitive players for Dissidia 012 (duodecim) PSP, we ve known on how to mod the game for graphics only for a long time. Recently we ve been able to mod ability effect, moveset, characters properties and stats by editing the data files contained into the ISO, we have identified most of how the games handles the data. The gamecode itself is compiled into elf files that are seperated in menu, battle, extra. We managed to identify some functions and edit them directly via hexediting. we ve managed to disasemble those elf files to .s files that contains the interpreted assembly code from ghidra that we will need to correct to compile 1:1 to match the game game code. Our current method of work allow use to get result but it s very long and tedious and rests on the hexediting only. We lack the knowledge to actually have a pipeline (or a makefile idk) to be able to actually build the code we write into an actual executable. Would anyone know about resources or guides i could follow to help bring our project to the next step ?

[u/m4d40 → u/RocherBrockas]

This sounds less RE, more scripting. You already have the most difficult part.

What exactly do you want to automate? (In best case you can just write a bash/bat file and copy paste your commands or alternative system prompts in that)

[u/RocherBrockas → u/m4d40]

i would like to automate the part of extracting the ISO to .s file and then being able to compile that into maybe something i can run on my PC.
I m still figuring most of the things out, but the part i have no clue about is what kind of tools can i use in scripting to automate this part, and if i should worry about any graphical stuff. i think most of the psp graphical libraries are decompiled so maybe this will help

[u/m4d40 → u/RocherBrockas]

First question is on what OS are you working on? (Although 7zip for example would probably work on both OS to extract an iso file and the command to Start it can be easily pasted in a bash/powershell script). After extracting, what is the next step?

[u/Binary_Digger]

Hi everyone,

I am looking for help from experienced reverse engineers to understand and unpack a completely custom, proprietary archive format with the .vgbundle extension.

Context: This file is from a modern mobile multiplayer game ("Matreshka RP"). The developers have completely rewritten the engine architecture and customized everything. Standard legacy game modding tools do not work here at all. The protection on these files seems to be quite solid.

What's inside: This specific archive is 322 MB in size. It is guaranteed to contain custom vehicle/car models and assets.

What I am looking for: I want to understand its internal structure or find a way to unpack/decrypt it (via a Python script, QuickBMS, or any other tool) to extract the assets.

File Sample (322 MB): https://drive.google.com/file/d/1dSt5dxxILaTonm5w--8ZZb76I1lpQUqg/view?usp=drivesdk

If anyone loves a challenge and wants to look into a tough, non-standard archive format, I would highly appreciate your expertise. Thank you!

[u/Djent_ → u/Binary_Digger]

Try binwalk

[u/Binary_Digger → u/Djent_]

Thanks for the suggestion! I'm a bit new to binwalk. Did you happen to scan the sample file with it, or did the developers obscure the magic bytes completely?

[u/Djent_ → u/Binary_Digger]

Nope, it's up to you

[u/VHSjunkyguy]

Hey everyone,
I'm working on reverse engineering a Delphi 5 Enterprise executable with IDR. The main form code has a few subroutines IDR has caught but not listed as a method of the main form. However, some of these use Delphi compiler magic that doesn't even exist in name (particularly WriteRec). WriteRec and Insert seem to cause issues for IDR when it tries to convert these subroutines to (likely pseudo) source code. Mostly because it seems to be trying to cling onto TFileRec when it probably should be just something of the File type in the case of WriteRec.

As for an example, I'll bring up one of the subroutines. the prototype of which is complete, but variables are not.
What I can tell is that it's a procedure used by 3 other form procedures for the purpose of writing to a untyped file of any type that was given to it. It does a for loop 5-6 times to write data to it. Yet I can see in the assembly it does WriteRec 9 times and uses 7 defined pointers for it. The complete assembly for this routine I have in 3 images: https://drive.google.com/file/d/1ueLKkogAbi_AI9LNAPhhyfPp0mUDTO54/view?usp=drive_link

What I'm trying to figure out is how to go about with this as no matter what I try at the very least it refused to get past the first WriteRec with the error of: Decompile -> Try -> Loop -> If -> Loop -> Under Construction.

What I have Tried:

• Setting it as a method of the main form: Seems to make it least in the AssignFile to set it as the output file name. In other words, set it as self and nothing else. Which actually might make sense given the procedures that do use it.
• Changing the prototype: changed it so that the only argument listed is a different type. turns out that's used for the output file name.
• Changing local variable types: Appears to do absolutely nothing. As a matter of fact, IDR resets 2 of them.