AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |
Back to Blog
Space pinball microsoft11/27/2023 We had several million lines of code still to port, so we couldn’t afford to spend days studying the code trying to figure out what obscure floating point rounding error was causing collision detection to fail. Heck, we couldn’t even find the collision detector! Two of us tried to debug the program to figure out what was going on, but given that this was code written several years earlier by an outside company, and that nobody at Microsoft ever understood how the code worked (much less still understood it), and that most of the code was completely uncommented, we simply couldn’t figure out why the collision detector was not working. In particular, when you started the game, the ball would be delivered to the launcher, and then it would slowly fall towards the bottom of the screen, through the plunger, and out the bottom of the table. The 64-bit version of Pinball had a pretty nasty bug where the ball would simply pass through other objects like a ghost. But one of the programs that ran into trouble was Pinball. One of the things I did in Windows XP was port several millions of lines of code from 32-bit to 64-bit Windows so that we could ship Windows XP 64-bit Edition. There is apparently speculation that this was done for legal reasons. and the decompiler has misinterpreted it as a longlong because of the access patterns (64bit pointers).Windows XP was the last client version of Windows to include the Pinball game that had been part of Windows since Windows 95. So I think this might be part of an initialization function for some property on top of a object that exists at *param_1. The 0x2b part I'm not sure about myself but it looks like some other kind of similar checks.Īnd actually then thinking about the way it's calling it, i'm wondering if this is actually from some C++ standard library code for doing stuff with a vtable, looking up the vtable entry and checking it's validity before calling it (in this case, location 0x18, and checking some kind of RTTI at 0x28 and 0x2b) and storing that it's been initialized in 0x21. From my memory, the windows ABI uses the first two bytes of functions for installing hooks/debugging by patching the first two bytes into some kind of jump (while originally being nops). This particular one looks like it's taking a function pointer in and checking if it's a valid function (not null) and then checking the first two bytes of the function. The sibling comment covers it a bit more in detail, but it's largely just some guessing and as much an art to figuring out what the types are or could be. (disclosure: per the child post, my original assumption that OpenRCT2 was copied out of Hex-Rays was inaccurate, since it was originally written in assembler it didn't follow a standard C ABI and the decompiler wouldn't work properly anyway). For example, OpenRCT2 started as a repository full of manually created source with Hex-Rays names and slowly evolved module-by-module into readable source code. Highly manual process, for some files it's just pattern matching / renaming and goes really quickly, for others it's full reimplementation and a bit harder.Īnd, if you look at most "decompiled game" projects, I think this is the industry standard way to do this. When I've done this in the past, it basically consists of:ġ) Decompile project using Ghidra/IDA, first pass.Ģ) Load symbols if present (sounds like there was a PDB for this one, which makes things a lot easier).ģ) Read decompilation/asm for unnamed subs and try to name them based on what they do.Ĥ) Export all decompiled source into an editor and start copy/paste/editing into readable source. I'm not aware of any good general-case automation for this.
0 Comments
Read More
Leave a Reply. |