I got inspired by various decompilation projects of old video games and decided to do one myself. I specifically chose "Tenchu: Stealth Assassins", a game for the PlayStation.
I haven't asked around, but I assumed nobody else out there had both the skills for reverse-engineering video games in general and motivation to work on this game in particular. I started reverse-engineering the game with Ghidra and quickly realized that "this game's code is kind of held together with glue and duct tape" (quoting a speedrunner of this game). It's quite the understatement: the code's a complete tangled mess.
I realized that with my current tooling and knowledge there was no way I could hope to complete this decompilation project by myself. I wanted to divide and conquer the problem into smaller, reasonably-sized pieces, but I just have one big executable and I can't just split it into pieces... or can I?
So I tried to innovate my way out of this mess. Ironically, perfecting the unlinking process and making it usable in practice has taken a long time, but it was intellectually rewarding and progress was tangible, so I did not lose motivation along the way.
As for the reverse-engineering of the game itself, my biggest achievement so far is managing to unlink the archive code from the game into a relocatable object file and writing an utility that leverages it to extract files from the game data archive. That sounds complicated, but with my tooling I just need to identify and annotate about 30 functions and global variables used in that part of the program to be able to export it, independently of the rest of the program. Then it's just a matter of writing some C glue code, compiling it to a Linux MIPS program and using QEMU user mode emulation to run the utility, without ever having rewritten that archive code in C or figuring out how it actually works.
> As for the reverse-engineering of the game itself, my biggest achievement so far is managing to unlink the archive code from the game into a relocatable object file and writing an utility that leverages it to extract files from the game data archive. That sounds complicated, but with my tooling I just need to identify and annotate about 30 functions and global variables used in that part of the program to be able to export it, independently of the rest of the program. Then it's just a matter of writing some C glue code, compiling it to a Linux MIPS program and using QEMU user mode emulation to run the utility, without ever having rewritten that archive code in C or figuring out how it actually works.
I figured you’d have to be exceptionally proud of this. I don’t find this specific, yet extremely useful skill, to be common among reverse engineers.
