(1/x) For some reason people keep asking me how to get into reverse engineering. The obvious answer would be do CTFs or reverse malware (aka just do it), but I also think game hacking/modding (not cheating!) can be fun and still provide the same learning experience. An example:
(2/x) I like to reverse old games (~2010ish) because their complexity is manageable and I'm old. In this example we will reverse a certain diablo clone. But first you need a goal, because reversing without a goal never works. Pick something simple, like changing a string.
(3/x) I like to start with reversing the game .exe's main function in IDA, trying to understand how the game works, but you could also start e.g. by looking for strings and where they are used. So I start renaming functions and making sense of the game binary:
(4/x) This function that loads a resource stands out. Games often store strings in resources, and there is some custom encryption going on - the resource is thus encrypted:
(5/x) If we set a breakpoint in IDA after decryption, we see strings:
(6/x) We can dump the resource with resource hacker and implement the decryption algorithm and its inverse (the encryption) in a script. LLMs can usually one-shot these scripts if your decompilation has properly named variables.
(7/x) Now we can decrypt the resource, change a string and repack the game .exe with the new resource:
(8/x) Finally, we can see our string changed in game!
(9/9) What did we learn? - Win32 APIs for resource management - Practice with debuggers, hex editors and disassemblers/decompilers - Reversing custom encryption algorithms All skills that transfer to e.g. malware analysis too, as you will face similar techniques.
Also: Most of these games also have multiplayer servers - if you are into protocol RE or vulnerability research, these binaries can be great targets.
@eversinc33 extremely good advice! i also entered the malware field through game hacking - particularly server emulation and client-sided modding. bonus points if the game you're modding uses an annoying anticheat and is packed/heavily obfuscated
@shavitush Very cool! Server emulation also translates well into malware analysis. And in general just super interesting
@eversinc33 What about an approach to reversing an undocumented windows function? Feel like that can seem intimidating at first.
@m3mSurfer In my opinion its not that bad, as Windows ships debug symbols for a lot of DLLs. Also lots of info to be found on reactos, geoff chapells blog etc. Any specific function?
@eversinc33 instructions unclear. accidentally ran the malware instead of analysing it. now when i boot up a cmd prompt keeps asking me if I want to play a game of global thermonuclear war. on the bright side, my toaster is now mining bitcoin and my smart fridge is texting my ex. progress?
@3itchless just go with the flow ๐
@eversinc33 I feel old diablos are so much fun to reverse
@hegx86 I never looked at the originals but I played so many different diablo clones/likes in my childhood xd