Using Ghidra and Python to reverse engineer Ecco the Dolphin

I know some of these words!

Thanks! I didn't clock that - should have looked at the decrypted values!

Binwalk claims to recognize crc polynomial tables i wonder if it could find this one.

Also someone needs to integrate binwalk & ghidra, they synergize too much.

Do you have any tips on knowing how the value is a result of CRC32 and/or the polynomial/initial value used?

> I sat down for the afternoon with a pen and paper and somehow managed to decode the password system

Would love to hear more about this, if you have any recollection :)

Philosophically, I would argue that you did not complete the game.

You skipped several levels and saw only some percentage of the intended content, gameplay, story, etc. Games in general, and Ecco the Dolphin is no exception, are very much about the journey and not just the destination. You missed out on themes & experiences like isolation, making friends with those outside of your in-group, conservation, time travel, communing with dinosaurs and, of course, space travel.

So, you really shouldn't have felt so guilty.

What a final level, though! Having skipped a large chunk of the game, were you surprised by it?

You must be the only Person in the world that Beat this Game, cheating or otherwise.

Also Gyugyu might be a reference to the Hungarian movie: "The Fifth Seal"

"Just imagine you are about to die, but you will be reincarnated in to one of two people; a slave or the rich master. The slave suffers under the master. He has his tongue and an eye removed and his wife and child are killed. He goes on living knowing he is a good person, as he never committed such appalling, sadistic acts on another like his master has done. The rich master has no moral qualms about it at all. He doesn't think what he did was wrong; the slave needed to be punished. You have the choice, whether to be a poor and righteous slave or be a rich and corrupt master."

Gyugyu is the name of the slave.

https://www.imdb.com/title/tt0075467

The programmers for this game were in Budapest, so this is a good guess!

Popely with a Hungarian "ly" was a giveaway too

Cocorico in french, very close :)

See also: the town of Kakariko in Zelda which always has chickens

could it be that the rooster/cockadoodledoo is something performed like clockwork in the morning, so the showing framedata also being tangential to time and clocks ? probably not

> I've been hoping there exist techniques more systematic than "see what values change between memory snapshots".

FWIW this is pretty much the standard method for locating value locations in RAM. It actually works pretty well. Some emulators have tools built in for that, like Dolphin for example. Even old game hacking tools like the Gameshark for N64 used the technique, with an on-console UI. I don't know if any Dreamcast emulators have tools for it or not.

I wrote about the technique in Dolphin here (and the followup article is also about console game hacking with Ghidra): https://www.smokingonabike.com/2021/01/17/hacking-super-monk...

I've poked around a bit with that game! The main trick is to import the memory snapshot (various ways of dumping it to a file; people like Cheat Engine for this) into Ghidra.

Ghidra can analyze the SuperH processor machine code natively, so the auto analysis will turn up lots of functions.

Are you sure you don't miss modern features like mandatory network connectivity and micro transactions?

What happened to their car? I didn't see anything about that in the post or comments.

It's like debugging.. I'm sure you must have worked on an unfamiliar code base at some point and had to figure it out. Instead of having the source you have the binary and using tools like Ghidra you can start to piece together the source but you'll still need to reason over it the very same way you did on that unfamiliar codebase and this time there's no comments at all ( which isn't uncommon in a lot of source available projects mind you )

So you're probably already half way there. Being familiar with assembly code helps of course.

run through http://microcorruption.com or https://crackmes.one/ for closer to real-life examples

I personally learned a lot by messing in Cheat Engine, it is way more capable than I thought, specially because I mostly used it as a kid and never looked back.

It is a great tool to get started with assembly in my opinion because the disassembler is good enough and you can write what they call 'assembly scripts' which provides the foundation on doing memory patches in x86 asm. Then from that you can start writing your own utils to patch the games at your own will.

You can do crazy cheats by patching the game just with Cheat Engine!

I knew some from school, but stepping through a debugger with a video game that I remembered from childhood was a better education on computer engineering than anything I got in class.

The games are worth a fortune. I gave mine away in 2005 and now I get heart palpitations when I look them up on eBay.

Have fun!

https://terraonion.com/en/producto/terraonion-mode/

The name of the game probably comes from dolphins echolocation ability. Another explanation I like to entertain is that the name is a reference to John C Lilly. He was a scientist who believed in an alien organization called the Earth Coincidence Control Office or E.C.C.O. He also studied dolphin intelligence and communication. He gave dolphins LSD in an effort to communicate with them. John C Lilly is an interesting rabbit hole to go down.

My favorite aspect is the music, I regularly listen to the OST while working: https://youtu.be/tqMuvFEKCOk

I've played a decent amount (never finished it), but I never understood why people say it's a horror game?

It really is a game with a strange mix of aesthetics. Blue skies and bright colors in the early levels; suspense and dread and supernatural stuff in the later levels.

Another Ed Annunziata game called Three Dirty Dwarves is also stylistically unique.

It's very much the "how", what were you looking for that's not explained in the blog post?

Yeah, exactly! I took a couple memory snapshots of the name "AAA" and then threw out all of the addresses that had values that didn't match the first snapshot. Then I changed it to "BBB" and threw out all the addresses that did match.

There's a program called Cheat Engine that can make this a point and click thing; that's usually how people find GameShark-style codes.

The next parts I vaguely remember: swim _very_ slow past an octopus arms (there's a hint but it's not necessarily clear that you have to be barely moving at all), hit key crystals and then the corresponding ~door crystals, and push a rock to drop and follow after them to avoid getting pushed back by the current.

It's generally a series of puzzles of that form and there's some ~light combat stuff.