Restoration of differing revisions of games' execuables
Posted: Sat Nov 07, 2020 4:36 am
Hi all,
Let me write about a collection of repositories, found here: https://bitbucket.org/gamesrc-ver-recreation/
What you can find in these repositories for most is reverse-engineering of code related to DOS games. However, rather than reversing a whole DOS game, what I usually do here is reverse different versions of games which were already open-sourced.
This idea came to me after the open-source release of not just one, but multiple DOS versions of Softdisk's Keen Dreams title. To be more specific, I downloaded the git repository and then had a look at the revision matching shareware v1.13. Using what I assumed to be the exact process for making the EXE, I got precisely the original EXE from the 90s, byte-by-byte. This process included usage of the right compiler version, as well as packing the EXE with LZEXE 0.91.
As for the above-mentioned repositories, the success rates greatly change, depending on the game in question, and especially the compiler in use (including the compiler version).
A more successful example is Wolfenstein 3D. Here, the executables from multiple versions of the game, including differing Apogee versions, can be fully recreated byte-by-byte, if done with the right tools and the right steps. It's possible that some luck might also assist, due to unintentional dependencies of the compiler and/or any other tool on the environment.
In other cases, there may still be differences in the output files. For instance, due to the way certain versions of Watcom C32 (v10.0b and older from what I know) behave, it may fill gaps between C string literals with data which depends on the environment, and/or on the textual contents of the input source code. This applies to the game code from Duke Nukem 3D: Atomic Edition v1.5, just for the example.
My most recent work is on the Heretic and Hexen sources; This only covers id Tech 1 code, not DMX. I did technically use DMX files in order to build the exes, but that's it; The changed code was from id or Raven.
For Heretic, this covers shareware and registered v1.0, which are quite similar. Another covered version is 1.2, which isn't very different from 1.3. The open source release itself turned out to match 1.3 in behaviors.
For Hexen, the open-source release basically matches one of two versions identified as "1.1". It's the latter out of the two, and the only practical difference between them is the addition of two checks to A_SoAExplode before spawning a monster, with one of them being a check of the boolean variable "nomonsters". The VERSION_ID string in the MAKEFILE was also changed from CBI to BCP.
Most of the work was actually in reversing version 1.0, or as it was later found out, two very similar variations of it again. The only actual difference between them is that the latter build had the addition of a check of the boolean variable "i_CDMusic" to P_SetupLevel, before calling S_StartSongName.
Regarding sound effects and music, back when Nuke.YKT was working on his PCDoom port, he made a wrapper over DMX, which is actually using the Apogee Sound System. While it obviously sounds different from DMX, it's a GPL-compatible alternative.
Therefore, I decided to add this wrapper under its own git submodule named "apodmx", with a few modifications. It can be built as a .LIB file which can be used with the Heretic or Hexen sources. You also need a compatible AUDIO_WF.LIB file from the Apogee Sound System.
Let me write about a collection of repositories, found here: https://bitbucket.org/gamesrc-ver-recreation/
What you can find in these repositories for most is reverse-engineering of code related to DOS games. However, rather than reversing a whole DOS game, what I usually do here is reverse different versions of games which were already open-sourced.
This idea came to me after the open-source release of not just one, but multiple DOS versions of Softdisk's Keen Dreams title. To be more specific, I downloaded the git repository and then had a look at the revision matching shareware v1.13. Using what I assumed to be the exact process for making the EXE, I got precisely the original EXE from the 90s, byte-by-byte. This process included usage of the right compiler version, as well as packing the EXE with LZEXE 0.91.
As for the above-mentioned repositories, the success rates greatly change, depending on the game in question, and especially the compiler in use (including the compiler version).
A more successful example is Wolfenstein 3D. Here, the executables from multiple versions of the game, including differing Apogee versions, can be fully recreated byte-by-byte, if done with the right tools and the right steps. It's possible that some luck might also assist, due to unintentional dependencies of the compiler and/or any other tool on the environment.
In other cases, there may still be differences in the output files. For instance, due to the way certain versions of Watcom C32 (v10.0b and older from what I know) behave, it may fill gaps between C string literals with data which depends on the environment, and/or on the textual contents of the input source code. This applies to the game code from Duke Nukem 3D: Atomic Edition v1.5, just for the example.
My most recent work is on the Heretic and Hexen sources; This only covers id Tech 1 code, not DMX. I did technically use DMX files in order to build the exes, but that's it; The changed code was from id or Raven.
For Heretic, this covers shareware and registered v1.0, which are quite similar. Another covered version is 1.2, which isn't very different from 1.3. The open source release itself turned out to match 1.3 in behaviors.
For Hexen, the open-source release basically matches one of two versions identified as "1.1". It's the latter out of the two, and the only practical difference between them is the addition of two checks to A_SoAExplode before spawning a monster, with one of them being a check of the boolean variable "nomonsters". The VERSION_ID string in the MAKEFILE was also changed from CBI to BCP.
Most of the work was actually in reversing version 1.0, or as it was later found out, two very similar variations of it again. The only actual difference between them is that the latter build had the addition of a check of the boolean variable "i_CDMusic" to P_SetupLevel, before calling S_StartSongName.
Regarding sound effects and music, back when Nuke.YKT was working on his PCDoom port, he made a wrapper over DMX, which is actually using the Apogee Sound System. While it obviously sounds different from DMX, it's a GPL-compatible alternative.
Therefore, I decided to add this wrapper under its own git submodule named "apodmx", with a few modifications. It can be built as a .LIB file which can be used with the Heretic or Hexen sources. You also need a compatible AUDIO_WF.LIB file from the Apogee Sound System.