Foone🏳️⚧️
so I've got an idea for a tool: a visual autocorrupter.
How it works is that you point it at the level-1 for a game.
And you set it up to repeatedly start the game and the first level.
The first time, it takes a screenshot.
Then it randomly corrupts that level file by changing individual bytes, and watches the screenshots of the resulting runs, telling you when a new change is discovered
Foone🏳️⚧️
you'd also have it detect game crashes, so you can ignore those changes.
But you could find out which byte in a game map corresponds to a specific object by standing in front of it and randomizing the level until the object changes.
Foone🏳️⚧️
annoyingly I want to first test this out on a DOS game. if this was for something I could run in Bizhawk, I'd basically be 90% done already, because I already have automation to do much of this
Foone🏳️⚧️
@sabik basically. but as an aid to reverse engineering, rather than vulnerability research or bug testing
sabik
@foone
Like mutation-based fuzz testing?
Foone🏳️⚧️
ahh, no, not jpc-rr! I haven't touched that emulator in, uh, 15 years? and I still have trauma from how crap it is
(important note: I am on the git-blame for jpc-rr, so it is technically at least partially my fault)
Foone🏳️⚧️
hah. one of the accepted ways to do DOS TASes on tasvideos.org is to use PCem inside libTAS.
they're not technically TASing the game, they're tasing /the whole fucking emulator/
Foone🏳️⚧️
okay I have a script that launches DOSBox, does a pseudo-tas where it hits keys at specific times, then takes a screenshot.
I just need to hook it up to something to randomly mutate the file and I'll have what I need
Foone🏳️⚧️
It runs! Slowly (about 18s a run) but it is running and I'm going to sleep
Foone🏳️⚧️
@timotimo no, not yet.
Timo the timo
@foone this doesn't exactly go in the right direction, but have you played with `rr` yet? the record&replay tool. runs on linux x86_64 and is capable of recording graphical programs as well. in fact, it's been developed for use with firefox.
it may not be trivial to trace back from screen pixel contents to map file contents, but being able to set a hardware watchpoint and then run execution backwards until you hit it is absolutely magical.
you use the replay part of rr with gdb, which you'd then probably want to script in python (or guile).
there's a paid offering from the rr developers called "pernosco" which has a "trace any value backwards through instructions" that also lets you do that for pixels on the graphical output of your program.
in any case, rr has been huge for bug hunting for me, maybe you can find a place for it in your heart^Wtoolbox as well
Foone🏳️⚧️
I woke up and it's on run 1371. The emulator hasn't crashed yet, which I'm slightly surprised about
Foone🏳️⚧️
I figured out how to make it faster. I forgot I can abuse save states a little
Foone🏳️⚧️
I normally can't do save states because the whole point is that I need the game to parse its own files, but I'm doing a load-game which reloads all that.
I could do a savestate right before the load-game and save (no pun intended) a lot of time menuing, because these menus are slow for no reason
Foone🏳️⚧️
I should probably hack the menus to not be slow
Foone🏳️⚧️
It makes sense in the 3.4 release because it's trying to play stupid noises on the PC speaker which uses 100% of the CPU, but I'm doing the 1.0 release which doesn't have speech
Foone🏳️⚧️
It waits a bit over a second between each menu selection, but it's not doing anything, it's just waiting
Foone🏳️⚧️
So here's the "control" picture with no changes
Foone🏳️⚧️
here's the glitchy ones. Tagging @mcc #glitches4andi
This one is an angel, I think
Foone🏳️⚧️
not sure what's going on here
Foone🏳️⚧️
some are interesting because they're at the wrong place: that means the savegame didn't load. The only reason it wouldn't load is because the map geometry at the start of the level is so fucked that it crashes the game and I can't get to the save/load menu
Foone🏳️⚧️
I don't know why it's so easy to change one byte in the file and generate 3d printer spaghetti
Foone🏳️⚧️
this one is weird because it's correct, except the whole map seems to have shifted one sector east. How?
I thought it was the player position being wrong, but nope! you can look at the coords in the hud and they're the same. The world moved, not the player.
Foone🏳️⚧️
This one is the most important. it looks like only one vertex moved!
I may have found the byte in the file that controls that one vertex!
Foone🏳️⚧️
You can see the inner-HUD here is still visible, as it is on some of the pictures.
That means the game crashed, because after loading the game the script hits "H" to turn it off.
Foone🏳️⚧️
I need to build a RAIDB system. That's a Redundant Array of Inexpensive DOSBoxes
I need more parallelization
Foone🏳️⚧️
I did speed it up using savestates. It's now about 10s per run instead of 20s
Foone🏳️⚧️
but it'd be cool to do this in parallel across a bunch of computers. that'd be good for when I need to do more of this, which I hope to in the future
Foone🏳️⚧️
@blueacid the problem right now is that I can't properly route keypresses to multiple windows, so I can only do one instance
blueacid
@foone how many simultaneous instances can you run on your hardware? I'd wager that you could run a few before hitting a CPU or memory limit? Especially with the 1s menu delay at play.
Foone🏳️⚧️
So this is interesting: Changing that byte made one vertex of the triangle change so that it matches a vertex from the river.
I bet that means this is a format where you define vertexes, then define shapes by connecting those vertexes together.
Foone🏳️⚧️
Yeah. Setting it to zero, to 1, and 2. It's grabbing points off the river, then it goes onto grabbing points off the other rocks.
Foone🏳️⚧️
BE NOT AFRAID
Foone🏳️⚧️
okay I found a byte defining the coordinate of one of the points.
(it looks diagonal because I'm looking down at an angle)
Foone🏳️⚧️
I have finished nudging every single byte of the map file! it took approximately 38 hours on and off. now to dig through the data
Foone🏳️⚧️
now I've got a script moving all the boring ones into a separate folder.
boring is defined by "has a perceptual hash equal to the control image"
perceptual hash is defined as "I cropped it to the viewport and stuffed the raw RGB into md5sum"
Foone🏳️⚧️
I think my game is being eaten by some linux
Foone🏳️⚧️
@smallsees I think the "I" in "ISF" stands for "ISIS" so it's probably not good.
(this game is from 1988, Isis here is the name of the 10th [sic] planet)
Programmer 832-529 🍅
@foone Is it a good thing or a bad thing if the ISF Forces are allowed to CSSG?
Foone🏳️⚧️
@smallsees I just went and checked the manual: It's actually International Space Force.
Programmer 832-529 🍅
@foone OK so the ISF force is the ISIS something force force.
"what should we call this planet"
"meh, just use some random Egyptian goddess or something, it doesn't matter"
Foone🏳️⚧️
@bslabs they can only eat you in the dark!
unfortunately, it's very dark in space
BSLabs
@foone Could be worse - at least it's not a grue.
０７６萌ＳＮＳ is a social network, courtesy of ０７６. It runs on GNU social, version 2.0.2-beta0, available under the GNU Affero General Public License.
All ０７６萌ＳＮＳ content and data are available under the Creative Commons Attribution 3.0 license.