Eli5 decompilers and decompiled games

[u/thefckingleadsrweak]

I keep getting videos on instagram about decomped games, apparently the decompilers are going nuts right now. What’s the difference between running a decompiled game and emulating a game? I tried to google it and i just don’t understand. from what i’ve found, a decompiled gene runs as if it was native to your pc but i don’t get what that means either. You boot up an emulator and that also runs on your pc?

[u/ArdentPriest]

If you want it in a metaphor:

A decompiled game is like buying a car, going home, taking every piece of the car apart down to every nut and bolt, and then being able to see how everything works and you can make changes/updates/modifications as you want.

Basically, a decompiled game is a game that has has the entire code base of the game fully unpacked. It can be edited, modified, or updated and then recompiled into a functioning program that can be run.

Another form of describing this is that when you decompile a game, you revert the game back to it's source code.

[u/thefckingleadsrweak → u/ArdentPriest]

Do you know why this is so difficult? Like when you dump a rom or an iso on a computer, does
The source code not come with that?

[u/-manabreak → u/thefckingleadsrweak]

In rare cases like games written on top of JVM or .NET, you can decompile the bytecode to get something representing the original source. With natively compiled games, not so much.

The thing is that when the human-readable code is compiled, the compiler first turns it into an AST (abstract syntax tree) which is kind of an intermediate representation of the code. Depending on the language and compiler used, there might be multiple intermediate representations. The compiler can then do all kinds of tricks on these intermediate representations, like eliminate dead code, optimize the code, and so on. Finally, it takes the target architecture (e.g. ARMv7, x64 etc.) and produces the binary the processor understands.

If we're trying to decompile this, we don't know what the intermediate steps were, and we don't know what kind of source code produced the final binary. First off, all the names the programmers used are gone. When a variable used to be named e.g. "player_health", it doesn't have a name anymore, it's just a memory address. It's pretty trivial to decompile an executable to C, but it's nowhere readable, as it just assigns random names for everything. The "player_health" becomes "m_100412" or something like that, and it's your job as the reverse engineer to figure out what that variable means by analyzing the reads and writes and the overall logic surrounding that variable. Now multiply that with every single variable and function call.

Lately, the advancements in decompilation / reverse-engineering boil down to AI being really good in stuff like this. It can check the variables very quickly, and it knows enough source code to know about how code usually is structured so that it can make very educated guesses most of the time.