Using Ghidra and Python to reverse engineer Ecco the Dolphin

(32bits.substack.com)

Comments

SideQuark 7 November 2024
The hash is merely a CRC32; exactly this one (polynomial 0x77073096, code is wrong)

https://web.mit.edu/freebsd/head/sys/libkern/crc32.c

(The decoded ints in the post are the constants in this CRC32).

Knowing it's a CRC32 and knowing the polynomial allows inverting the answers in log time instead of exponential time by exploiting the modular math of the polynomial rings.

qingcharles 7 November 2024
When the original Ecco came out on the Megadrive (Genesis), I spent all my hard-earned money to buy it. That game is obscenely hard. I got frustrated, so I sat down for the afternoon with a pen and paper and somehow managed to decode the password system. I teleported to the final level and completed it the next day.

Then I was wracked with guilt about spending all my money on a game I completed in two days.

praptak 7 November 2024
QQRIQ is a phonetic abbreviation of "kukuriku", which is the sound of the rooster in Hungarian and in several other languages (Polish "kukuryku", Hebrew " קוקוריקו" etc.). Makes wonder what the process for choosing the passwords was.
Liquix 7 November 2024
an interesting aside: when asked about his inspirations Ecco's developer Ed Annunziata said, "No, I never took LSD, but I did read a lot from John C. Lilly". Lilly is known for his pioneering work in the fields of animal intelligence, ketamine psychotherapy, isolation tanks, and consciousness exploration.

The name "Ecco" is a reference to Lilly's ECCO (Earth Coincidence Control Office), a supernatural/extraterrestrial base which John posited existed on the other side of the moon to coordinate all earthly "coincidences". He was also one of the first to recognize how intelligent dolphins were and became obsessed with figuring out how to communicate with them, going as far as flooding half of his house in the Carribeans to cohabitate. This is just the tip of the iceberg. I'd highly recommend his autobiography The Center of the Cyclone if any of this is intriguing, he's a fascinating guy

VyseofArcadia 7 November 2024
Great read!

Do you have any resources on getting started with Dreamcast game reverse engineering? I've been wanting to do some things with Skies of Arcadia, and I've been hoping there exist techniques more systematic than "see what values change between memory snapshots".

heisenburgzero 8 November 2024
I always wondered where to start learning reverse-engineering. Most people will say learn Assembly first. But from there on, there seems to be not much more concrete information online.

Do people just figured it out by trial & error like common patterns in x86 / arm / arcade platforms slowly?

I can't really find much discussion on details online.

mytaterskin 7 November 2024
I've taken to older games a lot more in recent years, they feel like they have a lot more soul if that makes any sense. Also sorry about your car! Not going to leave it idling in the driveway anymore, thanks for the warning.
skibz 7 November 2024
I'd love to see footage of the underwater soccer cheat in action.
fanoto 7 November 2024
Nice! Interesting how similar games seem to do this, checksumming to fixed integers. Pitfall: The Lost Expedition did something very similar by converting button presses into ASCII-represented strings of the input buttons that were then CRC-ed. The approach was similar to just brute-force in Python and compare to the extracted cheat hashes.

I even spy your CRC32 table hidden in the `decrypted_ints` . The pre-generated tables are so easily searchable. It leaves me curious why they are so often found obfuscated in attempt to make it more difficult compared to generating a new one with your own polynomial.

Kon-Peki 7 November 2024
Wow, a blog that focuses on the Sega Saturn!

Not too long ago, I found a Saturn in a closet at my parent’s house, along with a small handful of game CDs. I don’t have any recollection of owning one, so I’m guessing my little brother must have acquired it after I left for college. Anyway, I plugged it in and all the games worked! But other than that I have no idea what to do with it (obviously the trash is not an option).

bitbasher 7 November 2024
Can we just take a moment to appreciate how incredibly odd the Ecco series is? For anyone that beat the games. You go from swimming in an ocean to flying with aliens. It's bizarre. Some people classify it as a horror game.
butz 7 November 2024
You should look into PS2 version of this game, it seems to have same code for level unlock. Maybe it will be easier to reverse engineer and figure out what all codes do?
j0hnyl 7 November 2024
I wish there was more detail on "how" this was done as opposed to just the "what"
bt1a 7 November 2024
im curious about the process to find that initial buffer address - does that involve entering a few different strings and searching the memory snapshot for those byte patterns ?
wileydragonfly 8 November 2024
Anyone else never beat the second level? Yes, we all eventually figured out that we had to jump over the rock wall… but after that… then what?
jimmaswell 7 November 2024
The 3DS version was very cool. I plan on completing it there eventually. I wonder if those devs had source access.
n0id34 7 November 2024
I wish more people knew how to change to Ghidra's dark theme and change the font.
29athrowaway 7 November 2024
Is not this against the Ghidra EULA?