Tweet
Tweet

Slide 1

Slide 1 text

The day I reverse engineered a furry Gameboy Advance game With @macabeus D E F C O N F u r

Slide 2

Slide 2 text

WTF?! THE DAY I REVERSE ENGINEERED A GAMEBOY ADVANCE GAME

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

No content

Slide 5

Slide 5 text

No content

Slide 6

Slide 6 text

No content

Slide 7

Slide 7 text

No content

Slide 8

Slide 8 text

No content

Slide 9

Slide 9 text

github.com/macabeus/klo-gba.js

Slide 10

Slide 10 text

github.com/macabeus/klo-gba.js

Slide 11

Slide 11 text

Tools THE DAY I REVERSE ENGINEERED A GAMEBOY ADVANCE GAME

Slide 12

Slide 12 text

https://problemkaputt.de/gba.htm

Slide 13

Slide 13 text

https://www.hex-rays.com/products/ida

Slide 14

Slide 14 text

No content

Slide 15

Slide 15 text

Stretching the bridge THE DAY I REVERSE ENGINEERED A GAMEBOY ADVANCE GAME

Slide 16

Slide 16 text

No content

Slide 17

Slide 17 text

No content

Slide 18

Slide 18 text

No content

Slide 19

Slide 19 text

Here is the bridge

Slide 20

Slide 20 text

Here is the debugger panel

Slide 21

Slide 21 text

This is the tile ID. In this example, all tiles with the ID 9B are the bridge left-corner. 9A is the ID of the continuous part of the bridge.

Slide 22

Slide 22 text

This tells us where the tile is stored in the memory. In this example, it is at 0600F1AD.

Slide 23

Slide 23 text

https://www.coranac.com/tonc/text/hardware.htm

Slide 24

Slide 24 text

https://www.coranac.com/tonc/text/hardware.htm The address found is expected 0600F1AD given that everything between 0600 and 0601 is part of the section known as VRAM.

Slide 25

Slide 25 text

Our bridge starts here!

Slide 26

Slide 26 text

Our bridge starts here!

Slide 27

Slide 27 text

And now we grow it bigger!

Slide 28

Slide 28 text

And now we grow it bigger!

Slide 29

Slide 29 text

And now we grow it bigger! WTF??!

Slide 30

Slide 30 text

Understanding the DMA THE DAY I REVERSE ENGINEERED A GAMEBOY ADVANCE GAME

Slide 31

Slide 31 text

No content

Slide 32

Slide 32 text

No content

Slide 33

Slide 33 text

VRAM pulls the tilemap containing exactly what the player has to see from somewhere else that has the entire thing.

Slide 34

Slide 34 text

https://www.coranac.com/tonc/text/regbg.htm

Slide 35

Slide 35 text

https://www.coranac.com/tonc/text/regbg.htm Direct Memory Access D M A

Slide 36

Slide 36 text

https://www.coranac.com/tonc/text/regbg.htm DMA

Slide 37

Slide 37 text

https://www.coranac.com/tonc/text/regbg.htm It is a feature of computer systems that allows certain hardware subsystems to access main system memory (random access memory), independent of the CPU

Slide 38

Slide 38 text

https://www.coranac.com/tonc/text/regbg.htm tldr; makes copying and pasting faster

Slide 39

Slide 39 text

DMA3: 03000900 0600E000 80000400 DMA3: 03001100 0600E800 80000400 DMA3: 03004DB0 0600F000 80000200 DMA3: 03004800 07000000 84000048

Slide 40

Slide 40 text

DMA3: 03000900 0600E000 80000400 DMA3: 03001100 0600E800 80000400 DMA3: 03004DB0 0600F000 80000200 DMA3: 03004800 07000000 84000048 The closest to the bytes of our bridge (0600F1AD).

Slide 41

Slide 41 text

DMA3: 03000900 0600E000 80000400 DMA3: 03001100 0600E800 80000400 DMA3: 03004DB0 0600F000 80000200 DMA3: 03004800 07000000 84000048 In other words, VRAM is updated here

Slide 42

Slide 42 text

DMA3: 03000900 0600E000 80000400 DMA3: 03001100 0600E800 80000400 DMA3: 03004DB0 0600F000 80000200 DMA3: 03004800 07000000 84000048 This byte is the VRAM data source. It’s located in the Fast WRAM section.

Slide 43

Slide 43 text

No content

Slide 44

Slide 44 text

And going to this address…

Slide 45

Slide 45 text

Our bridge starts here!

Slide 46

Slide 46 text

Stretching it…

Slide 47

Slide 47 text

Stretching it… And…

Slide 48

Slide 48 text

Stretching it… …It works! And…

Slide 49

Slide 49 text

Stretching it… …It works! And… WTF??!

Slide 50

Slide 50 text

Stretching it… …It works! And… WTF??!

Slide 51

Slide 51 text

No content

Slide 52

Slide 52 text

No content

Slide 53

Slide 53 text

Our extra tiles disappear when out of the player vision range.

Slide 54

Slide 54 text

LET’S TALK ABOUT PHYSICS THE DAY I REVERSE ENGINEERED A GAMEBOY ADVANCE GAME

Slide 55

Slide 55 text

Object Attribute Memory O A M

Slide 56

Slide 56 text

OAM

Slide 57

Slide 57 text

No content

Slide 58

Slide 58 text

This is the address in which Klonoa is stored on the memory

Slide 59

Slide 59 text

DMA3: 03000900 0600E000 80000400 DMA3: 03001100 0600E800 80000400 DMA3: 03004DB0 0600F000 80000200 DMA3: 03004800 07000000 8400003E

Slide 60

Slide 60 text

DMA3: 03000900 0600E000 80000400 DMA3: 03001100 0600E800 80000400 DMA3: 03004DB0 0600F000 80000200 DMA3: 03004800 07000000 8400003E We can see exactly the byte that writes on Klonoa’s object (07000000).

Slide 61

Slide 61 text

DMA3: 03000900 0600E000 80000400 DMA3: 03001100 0600E800 80000400 DMA3: 03004DB0 0600F000 80000200 DMA3: 03004800 07000000 8400003E We can see exactly the byte that writes on Klonoa’s object (07000000).

Slide 62

Slide 62 text

No content

Slide 63

Slide 63 text

The first byte on an object defines the Y position…

Slide 64

Slide 64 text

…and updating it…

Slide 65

Slide 65 text

…and updating it…

Slide 66

Slide 66 text

…on running the next frame, we can notices that it changes the Klonoa Y position!

Slide 67

Slide 67 text

…on running the next frame, we can notices that it changes the Klonoa Y position! But also returns this byte for the correct value…

Slide 68

Slide 68 text

…and Klonoa continues to fall as to be nothing happened

Slide 69

Slide 69 text

No content

Slide 70

Slide 70 text

No content

Slide 71

Slide 71 text

Camera 03002926:03002927

Slide 72

Slide 72 text

Camera 03002926:03002927 63 00 63 00

Slide 73

Slide 73 text

Camera 03002926:03002927 63 00 63 00 In-game position 03002922:03002923

Slide 74

Slide 74 text

Camera 03002926:03002927 63 00 63 00 In-game position 03002922:03002923 88 01 76 01

Slide 75

Slide 75 text

Camera 03002926:03002927 63 00 63 00 In-game position 03002922:03002923 88 01 76 01

Slide 76

Slide 76 text

After a lot of researches, I found it:

Slide 77

Slide 77 text

Here is where updates the in-game Y position

Slide 78

Slide 78 text

Here is where it decides if it should update or not the Klonoa's position…

Slide 79

Slide 79 text

…and it uses the tile id stored at the Slow WRAM Here is where it decides if it should update or not the Klonoa's position…

Slide 80

Slide 80 text

https://www.coranac.com/tonc/text/hardware.htm

Slide 81

Slide 81 text

https://www.coranac.com/tonc/text/hardware.htm

Slide 82

Slide 82 text

After updating the tile map at the Slow WRAM…

Slide 83

Slide 83 text

After updating the tile map at the Slow WRAM…

Slide 84

Slide 84 text

LET’S find the tilemap on rom THE DAY I REVERSE ENGINEERED A GAMEBOY ADVANCE GAME

Slide 85

Slide 85 text

The data flow Cartridge

Slide 86

Slide 86 text

The data flow Cartridge Slow WRAM >

Slide 87

Slide 87 text

The data flow Cartridge Slow WRAM > Fast WRAM >

Slide 88

Slide 88 text

The data flow Cartridge Slow WRAM > Fast WRAM > VRAM >

Slide 89

Slide 89 text

The data flow Cartridge Slow WRAM > Fast WRAM > VRAM > Display >

Slide 90

Slide 90 text

Slow WRAM Our research flow Cartridge Display VRAM Fast WRAM > > > >

Slide 91

Slide 91 text

No content

Slide 92

Slide 92 text

Level loader instructions

Slide 93

Slide 93 text

swi… what?

Slide 94

Slide 94 text

i SW

Slide 95

Slide 95 text

SoftWare Interrupt i S W

Slide 96

Slide 96 text

SoftWare Interrupt i S W = Bios Calls

Slide 97

Slide 97 text

No content

Slide 98

Slide 98 text

BIOS is a firmware that is intended to initialise the physical components of the system

Slide 99

Slide 99 text

BIOS is a firmware that is intended to initialise the physical components of the system In GBA, its BIOS exposes many functions often used in games, including data compression and decompression

Slide 100

Slide 100 text

BIOS is a firmware that is intended to initialise the physical components of the system In GBA, its BIOS exposes many functions often used in games, including data compression and decompression Each function has an associated numeric code, which must be used as a parameter in the SWI statement

Slide 101

Slide 101 text

How division works on GBA: swi 0x06

Slide 102

Slide 102 text

How division works on GBA: swi 0x06 Input: R0 
 numerator R1 
 denominator

Slide 103

Slide 103 text

How division works on GBA: swi 0x06 Input: R0 
 numerator R1 
 denominator R0 
 numerator / denominator R1 
 numerator % denominator R3 
 abs(numerator / denominator) Output:

Slide 104

Slide 104 text

And in this case, the software is calling the Huffman Decompress and lz77 Decompress functions

Slide 105

Slide 105 text

Huffman + lz77 = deflate

Slide 106

Slide 106 text

No content

Slide 107

Slide 107 text

No content

Slide 108

Slide 108 text

No content

Slide 109

Slide 109 text

No content

Slide 110

Slide 110 text

6E 6E 6E B0 B1 BD 77 AB B3 AB B3 7C 6E 6E 6E 6E 6E 6E 6E 6E 7C 6E 6E 6E 6E 7C 6E 6E

Slide 111

Slide 111 text

6E 6E 6E B0 B1 BD 77 AB B3 AB B3 7C 6E 6E 6E 6E 6E 6E 6E 6E 7C 6E 6E 6E 6E 7C 6E 6E 6E 6E 6E B0 B1 BD 77 AB B3 AB B3 7C 6E 6E 6E 6E 6E 6E 6E 6E 7C 6E 6E 6E 6E 7C 6E 6E

Slide 112

Slide 112 text

6E 6E 6E B0 B1 BD 77 AB B3 AB B3 7C 6E 6E 6E 6E 6E 6E 6E 6E 7C 6E 6E 6E 6E 7C 6E 6E 6E 6E 6E B0 B1 BD 77 AB B3 AB B3 7C 6E 6E 6E 6E 6E 6E 6E 6E 7C 6E 6E 6E 6E 7C 6E 6E =

Slide 113

Slide 113 text

Let’s paint the tilemap THE DAY I REVERSE ENGINEERED A GAMEBOY ADVANCE GAME

Slide 114

Slide 114 text

0x1A 0x1B 0x1C 0x1D 0x1E 0x1F 0x1A 0x1B 0x1C 0x1D 0x1E 0x1F 0x1A 0x1B 0x1C 0x1D 0x1E 0x1F 0x1A 0x1B 0x1C 0x1D 0x1E 0x1F

Slide 115

Slide 115 text

0x1A 0x1B 0x1C 0x1D 0x1E 0x1F 0x1A 0x1B 0x1C 0x1D 0x1E 0x1F 0x1A 0x1B 0x1C 0x1D 0x1E 0x1F 0x1A 0x1B 0x1C 0x1D 0x1E 0x1F

Slide 116

Slide 116 text

0x1A 0x1B 0x1C 0x1D 0x1E 0x1F

Slide 117

Slide 117 text

H · W = 25020 
 H,W ∈ ℕ

Slide 118

Slide 118 text

No content

Slide 119

Slide 119 text

x x x x a x x x x 
 x x x x b x x x x I’m on tile a Below me is the tile b

Slide 120

Slide 120 text

x x x x a x x x x

Slide 121

Slide 121 text

x x x x a x x x x 
 x x x x b x x x x From the tile a to b there are 9 bytes (= 9 tiles), so the length of the tilemap is exactly 9 I’m on tile a

Slide 122

Slide 122 text

No content

Slide 123

Slide 123 text

Breakpoint here

Slide 124

Slide 124 text

The tile address which Klonoa is standing on

Slide 125

Slide 125 text

The tile address which Klonoa is standing on

Slide 126

Slide 126 text

When I change this byte…

Slide 127

Slide 127 text

When I change this byte… …it reflects right there, and it’s our tile a,…

Slide 128

Slide 128 text

When I change this byte… …it reflects right there, and it’s our tile a,… …at 02008439

Slide 129

Slide 129 text

Then we should update the tiles below Klonoa…

Slide 130

Slide 130 text

…to drop him one level Then we should update the tiles below Klonoa…

Slide 131

Slide 131 text

Then get the tile address on the one level below

Slide 132

Slide 132 text

Changing this byte…

Slide 133

Slide 133 text

Changing this byte… …we found the tile b!

Slide 134

Slide 134 text

Changing this byte… …we found the tile b! It's at 020085DD

Slide 135

Slide 135 text

02008439 - 020085DD = 1A4 (420) 
 The length of the level is 420!

Slide 136

Slide 136 text

Jimp github.com/oliver-moran/jimp

Slide 137

Slide 137 text

const Jimp = require('jimp') const { drop } = require('ramda') const fs = require('fs') const data = drop(3, fs.readFileSync(‘dump/level-1/tilemap'))

Slide 138

Slide 138 text

const Jimp = require('jimp') const { drop } = require('ramda') const fs = require('fs') const data = drop(3, fs.readFileSync('dump/level-1/tilemap'))

Slide 139

Slide 139 text

const getPixelColor = hexTile = > { if (hexTile === 0) { return 0x000000 } return 0xFFFFFF }

Slide 140

Slide 140 text

new Jimp(300, 600, (err, image) = > { let x = 0 let y = 0 for (let i = 0; i < data.length; i += 1) { const value = data[i] x += 1 if (x === 420) { y += 1 x = 0 } let color = getPixelColor(value) image.setPixelColor(color, x, y) } image.write('image.png') })

Slide 141

Slide 141 text

No content

Slide 142

Slide 142 text

No content

Slide 143

Slide 143 text

No content

Slide 144

Slide 144 text

No content

Slide 145

Slide 145 text

No content

Slide 146

Slide 146 text

No content

Slide 147

Slide 147 text

LET’S see the project THE DAY I REVERSE ENGINEERED A GAMEBOY ADVANCE GAME

Slide 148

Slide 148 text

Coding THE DAY I REVERSE ENGINEERED A GAMEBOY ADVANCE GAME

Slide 149

Slide 149 text

Stack

Slide 150

Slide 150 text

React.js GitHub Pages WebAssembly

Slide 151

Slide 151 text

React.js GitHub Pages WebAssembly

Slide 152

Slide 152 text

React.js GitHub Pages WebAssembly

Slide 153

Slide 153 text

React.js GitHub Pages WebAssembly

Slide 154

Slide 154 text

architecture

Slide 155

Slide 155 text

No content

Slide 156

Slide 156 text

🖌 Brush

Slide 157

Slide 157 text

🖌 ✂ Brush Scissors

Slide 158

Slide 158 text

Z 🖌 ✂

Slide 159

Slide 159 text

Z 🖌 ✂ Extract data 
 from the ROM Get constants values Update the 
 ROM data UI

Slide 160

Slide 160 text

Web assembly

Slide 161

Slide 161 text

Tilemap compressed > Old C code to uncumpress it Decompressed Tilemap >

Slide 162

Slide 162 text

Tilemap compressed >

Slide 163

Slide 163 text

Tilemap compressed > Old C code to uncumpress it Decompressed Tilemap >

Slide 164

Slide 164 text

Tilemap compressed > Old C code to uncumpress it Decompressed Tilemap > Emscripten WebAssembly > >

Slide 165

Slide 165 text

huffman.c lzss.c > Emscripten > huffman.wasm 
 lzss.wasm huffman.js 
 lzss.js +

Slide 166

Slide 166 text

const lzssModule = require('./wasm/lzss.js' ) const { FS } = lzssModul e const lzssDecode = (buffer) => { FS.writeFile('filelzss', buffer ) lzssModule._LZS_Decode( ) try { return lzssModule.FS.readFile('filelzss', { encoding: 'binary' } ) } catch (e) { throw new LzssDecodeError(e ) } }

Slide 167

Slide 167 text

const lzssModule = require('./wasm/lzss.js' ) const { FS } = lzssModul e const lzssDecode = (buffer) => { FS.writeFile('filelzss', buffer ) lzssModule._LZS_Decode( ) try { return lzssModule.FS.readFile('filelzss', { encoding: 'binary' } ) } catch (e) { throw new LzssDecodeError(e ) } }

Slide 168

Slide 168 text

const lzssModule = require('./wasm/lzss.js' ) const { FS } = lzssModul e const lzssDecode = (buffer) => { FS.writeFile('filelzss', buffer ) lzssModule._LZS_Decode( ) try { return lzssModule.FS.readFile('filelzss', { encoding: 'binary' } ) } catch (e) { throw new LzssDecodeError(e ) } }

Slide 169

Slide 169 text

const lzssModule = require('./wasm/lzss.js' ) const { FS } = lzssModul e const lzssDecode = (buffer) => { FS.writeFile('filelzss', buffer ) lzssModule._LZS_Decode( ) try { return lzssModule.FS.readFile('filelzss', { encoding: 'binary' } ) } catch (e) { throw new LzssDecodeError(e ) } }

Slide 170

Slide 170 text

const lzssModule = require('./wasm/lzss.js' ) const { FS } = lzssModul e const lzssDecode = (buffer) => { FS.writeFile('filelzss', buffer ) lzssModule._LZS_Decode( ) try { return lzssModule.FS.readFile('filelzss', { encoding: 'binary' } ) } catch (e) { throw new LzssDecodeError(e ) } }

Slide 171

Slide 171 text

const lzssModule = require('./wasm/lzss.js' ) const { FS } = lzssModul e const lzssDecode = (buffer) => { FS.writeFile('filelzss', buffer ) lzssModule._LZS_Decode( ) try { return lzssModule.FS.readFile('filelzss', { encoding: 'binary' } ) } catch (e) { throw new LzssDecodeError(e ) } }

Slide 172

Slide 172 text

function docker_run_emscripten { local filename="$1" echo "Compiling $filename..." docker run \ --rm -it \ -v $(pwd)/scissors/src/wasm:/src \ trzeci/emscripten:1.38.43 \ emcc -s WASM=1 -s ALLOW_MEMORY_GROWTH=1 -s MODULARIZE=1 \ -s EXTRA_EXPORTED_RUNTIME_METHODS=[\”FS\"] \ -s EXPORT_NAME=\"$filename\" -o ./$filename.js $filename. c } docker_run_emscripten huffma n docker_run_emscripten lzss

Slide 173

Slide 173 text

function docker_run_emscripten { local filename="$1 " echo "Compiling $filename... " docker run \ --rm -it \ -v $(pwd)/scissors/src/wasm:/src \ trzeci/emscripten:1.38.43 \ emcc -s WASM=1 -s ALLOW_MEMORY_GROWTH=1 -s MODULARIZE=1 \ -s EXTRA_EXPORTED_RUNTIME_METHODS=[\”FS\"] \ -s EXPORT_NAME=\"$filename\" -o ./$filename.js $filename. c } docker_run_emscripten huffma n docker_run_emscripten lzss

Slide 174

Slide 174 text

const extractFullTilemap = (romBuffer, addressStart) = > romBuffer.slice(addressStart ) |> huffmanDecod e |> lzssDecode

Slide 175

Slide 175 text

Saving the new tilemap

Slide 176

Slide 176 text

First Level Second Level Third Level Each level is stored continually in the memory

Slide 177

Slide 177 text

First Level Second Level Third Level

Slide 178

Slide 178 text

First Level Second Level Third Level Changes in the first level >

Slide 179

Slide 179 text

Customised

Slide 180

Slide 180 text

> Second Level Third Level Customised

Slide 181

Slide 181 text

> Second Level Third Level Customised

Slide 182

Slide 182 text

No content

Slide 183

Slide 183 text

Thumb ARM

Slide 184

Slide 184 text

Faster to run Instructions demand less memory Thumb ARM

Slide 185

Slide 185 text

Faster to run Instructions demand less memory Can perform more complex instructions Thumb ARM

Slide 186

Slide 186 text

No content

Slide 187

Slide 187 text

The switch between ARM and Thumb must be done by bx instruction.

Slide 188

Slide 188 text

The switch between ARM and Thumb must be done by bx instruction. This instruction only can read a register

Slide 189

Slide 189 text

The switch between ARM and Thumb must be done by bx instruction. This instruction only can read a register bx updates the PC by the register value used in its parameter

Slide 190

Slide 190 text

Very big hole space at the end of cartridge First Level Second Level Third Level Instruction to load a level

Slide 191

Slide 191 text

First Level Second Level Third Level Instruction to load a level Constant addresses map table Hole Customised level loader Customised First Level Customised Second Level Customised Third Level Hole Hole Hole

Slide 192

Slide 192 text

First Level Second Level Third Level Instruction to load a level Constant addresses map table Hole Customised level loader Customised First Level Customised Second Level Customised Third Level Hole Hole Hole 0836720 FC 27 1B 0 8 0836724 00 77 36 0 8 0836728 5C 3E 1B 0 8 083672C B0 86 36 0 8 0836730 AC 50 1B 0 8 0836734 80 93 36 08

Slide 193

Slide 193 text

First Level Second Level Third Level Instruction to load a level Constant addresses map table Hole Customised level loader Customised First Level Customised Second Level Customised Third Level Hole Hole Hole 0836720 FC 27 1B 0 8 0836724 00 77 36 0 8 0836728 5C 3E 1B 0 8 083672C B0 86 36 0 8 0836730 AC 50 1B 0 8 0836734 80 93 36 08

Slide 194

Slide 194 text

First Level Second Level Third Level Instruction to load a level Constant addresses map table Hole Customised level loader Customised First Level Customised Second Level Customised Third Level Hole Hole Hole 0836720 FC 27 1B 0 8 0836724 00 77 36 0 8 0836728 5C 3E 1B 0 8 083672C B0 86 36 0 8 0836730 AC 50 1B 0 8 0836734 80 93 36 08

Slide 195

Slide 195 text

First Level Second Level Third Level Instruction to load a level Constant addresses map table Hole Customised level loader Customised First Level Customised Second Level Customised Third Level Hole Hole Hole 0836720 FC 27 1B 0 8 0836724 00 77 36 0 8 0836728 5C 3E 1B 0 8 083672C B0 86 36 0 8 0836730 AC 50 1B 0 8 0836734 80 93 36 08

Slide 196

Slide 196 text

First Level Second Level Third Level Instruction to load a level Constant addresses map table Hole Customised level loader Customised First Level Customised Second Level Customised Third Level Hole Hole Hole

Slide 197

Slide 197 text

First Level Second Level Third Level Instruction to load a level Constant addresses map table Hole Customised level loader Customised First Level Customised Second Level Customised Third Level Hole Hole Hole Original Loader 08043B0A mov r4, r0 08043B0C add r0, r5, 4 08043B0E mov r1, r4 08043B10 bl 0805143Ch

Slide 198

Slide 198 text

First Level Second Level Third Level Instruction to load a level (patched) Constant addresses map table Hole Customised level loader Customised First Level Customised Second Level Customised Third Level Hole Hole Hole Original Loader 08043B0A mov r4, r0 08043B0C add r0, r5, 4 08043B0E mov r1, r4 08043B10 bl 0805143Ch Patched Loader 08043B0A mov r4, r0 08043B0C bl 08367610 h 080v3B10 bl 0805143Ch

Slide 199

Slide 199 text

First Level Second Level Third Level Instruction to load a level (patched) Constant addresses map table Hole Customised level loader Customised First Level Customised Second Level Customised Third Level Hole Hole Hole Patched Loader 08043B0A mov r4, r0 08043B0C bl 08367610 h 080v3B10 bl 0805143Ch R0 is the pointer to which the tilemap will be loaded. We should update it to the address of the custom level

Slide 200

Slide 200 text

First Level Second Level Third Level Instruction to load a level (patched) Constant addresses map table Hole Customised level loader Customised First Level Customised Second Level Customised Third Level Hole Hole Hole Patched Loader 08043B0A mov r4, r 0 08043B0C bl 08367610 h 080v3B10 bl 0805143Ch

Slide 201

Slide 201 text

First Level Second Level Third Level Instruction to load a level Constant addresses map table Hole Customised level loader Customised First Level Customised Second Level Customised Third Level Hole Hole Hole 08367610 mov r0, r15 ; r15 = PC
 08367612 add r0, 3Ch
 08367614 bx r0

Slide 202

Slide 202 text

First Level Second Level Third Level Instruction to load a level Constant addresses map table Hole Customised level loader Customised First Level Customised Second Level Customised Third Level Hole Hole Hole 08367650 add r0, r4, 4 h 08367654 ldr r4, [r15, #-3Ch ] 08367658 cmp r0, r 4 0836765C ldreq r0, [r15, #-40h ] 08367660 ldr r4, [r15, #-40h ] 08367664 cmp r0, r 4 08367668 ldreq r0, [r15, #-44h ] 0836767C ldr r4, [r15, #-44h ] 08367680 cmp r0, r 4 08367684 ldreq r0, [r15, #-48h ] 08367688 mov r4, r 1 0836768C bx r14

Slide 203

Slide 203 text

First Level Second Level Third Level Instruction to load a level Constant addresses map table Hole Customised level loader Customised First Level Customised Second Level Customised Third Level Hole Hole Hole 08367650 add r0, r4, 4 h 08367654 ldr r4, [r15, #-3Ch ] 08367658 cmp r0, r 4 0836765C ldreq r0, [r15, #-40h ] 08367660 ldr r4, [r15, #-40h ] 08367664 cmp r0, r 4 08367668 ldreq r0, [r15, #-44h ] 0836767C ldr r4, [r15, #-44h ] 08367680 cmp r0, r 4 08367684 ldreq r0, [r15, #-48h ] 08367688 mov r4, r 1 0836768C bx r14

Slide 204

Slide 204 text

First Level Second Level Third Level Instruction to load a level Constant addresses map table Hole Customised level loader Customised First Level Customised Second Level Customised Third Level Hole Hole Hole 08367650 add r0, r4, 4 h 08367654 ldr r4, [r15, #-3Ch ] 08367658 cmp r0, r 4 0836765C ldreq r0, [r15, #-40h ] 08367660 ldr r4, [r15, #-40h ] 08367664 cmp r0, r 4 08367668 ldreq r0, [r15, #-44h ] 0836767C ldr r4, [r15, #-44h ] 08367680 cmp r0, r 4 08367684 ldreq r0, [r15, #-48h ] 08367688 mov r4, r 1 0836768C bx r14

Slide 205

Slide 205 text

First Level Second Level Third Level Instruction to load a level Constant addresses map table Hole Customised level loader Customised First Level Customised Second Level Customised Third Level Hole Hole Hole 08367650 add r0, r4, 4 h 08367654 ldr r4, [r15, #-3Ch ] 08367658 cmp r0, r 4 0836765C ldreq r0, [r15, #-40h ] 08367660 ldr r4, [r15, #-40h ] 08367664 cmp r0, r 4 08367668 ldreq r0, [r15, #-44h ] 0836767C ldr r4, [r15, #-44h ] 08367680 cmp r0, r 4 08367684 ldreq r0, [r15, #-48h] 08367688 mov r4, r 1 0836768C bx r14

Slide 206

Slide 206 text

First Level Second Level Third Level Instruction to load a level Constant addresses map table Hole Customised level loader Customised First Level Customised Second Level Customised Third Level Hole Hole Hole 08367650 add r0, r4, 4 h 08367654 ldr r4, [r15, #-3Ch ] 08367658 cmp r0, r 4 0836765C ldreq r0, [r15, #-40h ] 08367660 ldr r4, [r15, #-40h ] 08367664 cmp r0, r 4 08367668 ldreq r0, [r15, #-44h ] 0836767C ldr r4, [r15, #-44h ] 08367680 cmp r0, r 4 08367684 ldreq r0, [r15, #-48h ] 08367688 mov r4, r1 0836768C bx r14

Slide 207

Slide 207 text

1. Redirect to the patched code 2. Check if the R0 is on the table 3. If yes, load the associated value 4. Return to the original loader

Slide 208

Slide 208 text

Result THE DAY I REVERSE ENGINEERED A GAMEBOY ADVANCE GAME

Slide 209

Slide 209 text

No content

Slide 210

Slide 210 text

No content

Slide 211

Slide 211 text

No content

Slide 212

Slide 212 text

No content

Slide 213

Slide 213 text

No content

Slide 214

Slide 214 text

No content

Slide 215

Slide 215 text

Other project THE DAY I REVERSE ENGINEERED A GAMEBOY ADVANCE GAME

Slide 216

Slide 216 text

react-gbajs github.com/macabeus/react-gbajs

Slide 217

Slide 217 text

WE ARE... THE DAY I REVERSE ENGINEERED A GAMEBOY ADVANCE GAME

Slide 218

Slide 218 text

BRUNO MACABEUS Senior Software Engineer 
 @outsystems macabeus bmacabeus

Slide 219

Slide 219 text

MATHEUS ALBUQUERQUE Special thanks for helping to develop the frontend at this talk ythecombinator www.ythecombinator.space

Slide 220

Slide 220 text

Raul peres Special thanks for drawing all the images Kniksis KniksisG

Slide 221

Slide 221 text

RayCarrot Special thanks for helping to extract the sprites from the rom RayCarrot RayCarrot

Slide 222

Slide 222 text

Ray1Map github.com/Adsolution/Ray1Map

Slide 223

Slide 223 text

Matt Greer Special thanks for helping to improve the emulator city41 www.mattgreer.dev

Slide 224

Slide 224 text

Smaghetti github.com/city41/smaghetti

Slide 225

Slide 225 text

This talk THE DAY I REVERSE ENGINEERED A GAMEBOY ADVANCE GAME

Slide 226

Slide 226 text

github.com/macabeus/klo-gba.js

Slide 227

Slide 227 text

github.com/macabeus/klo-gba.js

Slide 228

Slide 228 text

bit.ly/gba-posts

Slide 229

Slide 229 text

github.com/macabeus/klo-gba.js

Slide 230

Slide 230 text

github.com/macabeus/klo-gba.js

Slide 231

Slide 231 text

github.com/macabeus/klo-gba.js

Slide 232

Slide 232 text

bit.ly/theconf-gba

Slide 233

Slide 233 text

bit.ly/balccon-gba

Slide 234

Slide 234 text

OBRIGADO THANKS macabeus