Hacking a 25 Year Old Game to Make It Work [video](youtube.com)
youtube.com
Hacking a 25 Year Old Game to Make It Work [video]
https://www.youtube.com/watch?v=eQOOx4mmY6I
26 comments
Looks like the main blocking problem was that the game was stuck in a loop looking for a multimedia system DLL that was missing, because it assumed there would always be a CDROM available. OP lucked out that the code that called winmm.dll had a GitHub link and he could just patch it.
Too bad Microsoft has kind of softened and lost its reputation for Windows's impeccable backward compatibility. This seems like it could have been easily avoided on the OS side.
I'm currently trying to get Distant Worlds: Universe (which is less than half as old as Worms 2, no excuse Microsoft!) working on Windows 11. Same problem: No start, no error message. I'll try some of the tools and techniques highlighted in the video!
Too bad Microsoft has kind of softened and lost its reputation for Windows's impeccable backward compatibility. This seems like it could have been easily avoided on the OS side.
I'm currently trying to get Distant Worlds: Universe (which is less than half as old as Worms 2, no excuse Microsoft!) working on Windows 11. Same problem: No start, no error message. I'll try some of the tools and techniques highlighted in the video!
Microsoft used to keep a really good Shim library to hot patch troublesome applications. Application Compatibility Toolkit (ACT)/Microsoft Windows Application Compatibility Infrastructure.
https://learn.microsoft.com/en-us/windows/deployment/plannin...
This hack could be accomplished with one of those. In fact here is something that might work https://ryanwill.com/create-and-use-shims-with-microsoft-app...
>CorrectFilePaths – These are similar to symbolic links, but are defined per .EXE instead of system wide
https://learn.microsoft.com/en-us/windows/deployment/plannin...
This hack could be accomplished with one of those. In fact here is something that might work https://ryanwill.com/create-and-use-shims-with-microsoft-app...
>CorrectFilePaths – These are similar to symbolic links, but are defined per .EXE instead of system wide
I've been working with getting games from 1995+ working on modern systems over the past two years, and honestly the biggest incompatibilities I've seen have been in the registry. Combined with some redirected filesystem calls, I really think you could get 98% of games working in a portable fashion.
The problem I have with some of these GoG releases is they just patch out buttons for things like networking, when features like local IPX multiplayer can still work with shims.
The problem I have with some of these GoG releases is they just patch out buttons for things like networking, when features like local IPX multiplayer can still work with shims.
It's always been a slow rot. Even in the XP days you'd run into issues. I remember Alpha Centauri did NOT like my dual core Athlon and it wasn't even a decade old at the time.
If this was a web service, the popular solution would be Docker!
But the joke might make more sense than it appears. Just like a server that was coded to work on a given version of Red Hat or Debian, wouldn't be expected to run without changes on modern versions 10 years later, I guess we shouldn't expect old games to run without a VM that replicates the system they were written to run on.
But the joke might make more sense than it appears. Just like a server that was coded to work on a given version of Red Hat or Debian, wouldn't be expected to run without changes on modern versions 10 years later, I guess we shouldn't expect old games to run without a VM that replicates the system they were written to run on.
> Looks like the main blocking problem was that the game was stuck in a loop looking for a multimedia system DLL that was missing, because it assumed there would always be a CDROM available. OP lucked out that the code that called winmm.dll had a GitHub link and he could just patch it.
Not quite, from my understanding.
The DLL was already patched in GOG version (using the one from GitHub) to redirect any resources from CD-ROM to a local one; however the patch isn't working in Win10 due to some relative path issues (which I'm not sure why; the issue is having system32/ prefix at various places, which Win10 does have?). He patched the DLL again by removing these system32/ paths, and it works again.
Not quite, from my understanding.
The DLL was already patched in GOG version (using the one from GitHub) to redirect any resources from CD-ROM to a local one; however the patch isn't working in Win10 due to some relative path issues (which I'm not sure why; the issue is having system32/ prefix at various places, which Win10 does have?). He patched the DLL again by removing these system32/ paths, and it works again.
The game is Worms 2.
Thanks - I wish this trend of burying every detail behind an abstract low information headline would end.
<Shocked face looking at normal background with a leading title...>
This guy is awesome, some of the most friendly and accessible Reverse Engineering content you'll ever see.
This was delightful. The theme brought back memories of trying to bypass copy protection on old games. And the chap doing it explains it beautifully.
Thank you very much for this link. This guy looks to do a great job of demystifying reverse engineering. Will be subscribing in the hope of learning something!
I didn't follow too closely when watching the video, so pardon me if it's already answered in the video: did he end up hijacking a different button for opening multi-player dialog? I assume there is no way to recover the removed multi-play button since the sprite (?) was already removed?
Also I'm surprised not only they removed the multiplayer button, they even centered the remaining one.
Also I'm surprised not only they removed the multiplayer button, they even centered the remaining one.
The sprites weren't modified. The vendor of the online version (GOG) had patched-out the button that he patched back in.
At 5:12 he showed what the menu should be like from an old screenshot, which has a multiplayer button (right bottom, "two computer double arrow to each other", refer as B2 below). On the left of it, it's a button of "a worm with a hard hat", refer as B1 below.
In his GOG copy, even after fix, there is only B1 and it's centered now to occupy the full space.
At the end of the video, after the fix, he was still clicking B1 button to enter "network play" since no B2 button is there.
So I'm still confused.
He didn't restore the missing button. But of course he did something. Did he re-bind the networkplay dialog entrance from missing B2 to B1? What happens if you just click B1 before the fix? Was B1's original functionality overridden by his fix?
Alternatively, if it's indeed supposed to be at B1 (I can't tell from icon what its functionality is), then why even mentioning the mission B2 to begin with?
In his GOG copy, even after fix, there is only B1 and it's centered now to occupy the full space.
At the end of the video, after the fix, he was still clicking B1 button to enter "network play" since no B2 button is there.
So I'm still confused.
He didn't restore the missing button. But of course he did something. Did he re-bind the networkplay dialog entrance from missing B2 to B1? What happens if you just click B1 before the fix? Was B1's original functionality overridden by his fix?
Alternatively, if it's indeed supposed to be at B1 (I can't tell from icon what its functionality is), then why even mentioning the mission B2 to begin with?
Very cool.
I wonder if this kind of work is something that LLMs will be good at someday. (Has anyone trained an LLM on machine code yet?) Is it reasonable to hope that 20 years from now you'll be able to say "Hey CodeGPT, this binary doesn't run on Windows 17, can you make a patch?" The deep understanding and creative thinking that Nathan Baggs demonstrates here seems far beyond the capabilities of any tool I'm aware of; on the other hand, even a relatively dumb AI supplemented by brute force might be good enough.
I wonder if this kind of work is something that LLMs will be good at someday. (Has anyone trained an LLM on machine code yet?) Is it reasonable to hope that 20 years from now you'll be able to say "Hey CodeGPT, this binary doesn't run on Windows 17, can you make a patch?" The deep understanding and creative thinking that Nathan Baggs demonstrates here seems far beyond the capabilities of any tool I'm aware of; on the other hand, even a relatively dumb AI supplemented by brute force might be good enough.
You need to be able to explain the goal sufficiently well, and then you need something goal-seeky to do the work, i.e. a closed-loop system.
LLMs are impersonators. They take a prompt and then make up something that relates to the prompt based on their corpus - they are open-loop systems in that sense.
LLMs are impersonators. They take a prompt and then make up something that relates to the prompt based on their corpus - they are open-loop systems in that sense.
I guess I was assuming the LLM would be wrapped into some larger goal-seeky thing. Explaining the goal seems like the easy part; it could be as simple as "Make it possible for execution to reach this function."
Reminds me of the unsung hero who was selflessly patching and fixing AOE2 for many many years before the AOE2 HD stuff on steam. These people are awesome.
If you're talking about the team behind Forgotten Empires, it was the same team that was hired to do AoE2 HD
[deleted]
Love this very cool explanation. Sort of guided puzzles solving tour.
But then he actually did it:
https://youtu.be/utEx3ZvPd8Y
Without any captured traffic to analyze. Badass.