Reverse Engineering/Game Patching Tutorial: Full Res RollerCoaster Tycoon with Ghidra+x64dbg+Python

Time Markers:
00:00:00 - Introduction
00:01:57 - Target audience and caveats note
00:03:10 - Start of tutorial
00:07:08 - Loading the file into Ghidra/First steps of RE workflow
00:14:27 - Static analysis of window creation functions (CreateWindowExA)
00:25:42 - Quick detour to learn about Window Style values
00:37:07 - Dynamic analysis of window creation functions in x32dbg
00:48:38 - Static analysis of default window height/width values
00:58:21 - Dynamic analysis of default window height/width values
01:03:30 - Static analysis of window constraints and patching for windowed mode
01:12:15 - Patching to enable full screen mode
01:15:00 - Python patching script review and wrap-up

Corrections:

00:34:30: When viewing GetSystemMetrics, 0x20 and 0x21 are seen passed into this function in Ghidra, but the MSDN page is in decimal, so those values (32 and 33 decimal) are actually specifying SM_CXSIZEFRAME and SM_CYSIZEFRAME, the sizing borders of the window. I mistakenly confused them for SM_CYVSCROLL/SM_CXHSCROLL.

Hey everyone, I appreciate you joining me for this inaugural tutorial.

I'm usually playing with malware, but I thought a game patch was a more fun and light endeavor for beginners, and I hope that this video strikes that balance of being fun and informative.

I hope to do more of these sometime, if there is an appetite.

Reach out any time with questions or feedback.

Free Learning Resources (Let me know if you have more, and I will update this list):

* Programming and Operating System Concepts:

* Reverse Engineering:

* Tools:

* Books:

[das_evoli]

I have no idea why this looks so fun to do. You feel like a damn detective

[siljamickeify]

I LOVE that you keep your mistakes in the tutorial!! It is soo valuable for a learner to see what is difficult even for the teacher!
Wonderful tutorial, both in content and style.

[StefanNoack]

34:27 you forgot to convert to decimal. 0x20 corresponds to the border size (entry 32) not the scrollbars. Which also explains why the value is doubled, since borders are on both sides. It doesn't matter, though :)

[tov]

1 and a half year later and it is still a great video! I always wondered how patches for older games were made and this video literally answers this question on point!

[NavnikBHSilver]

I have very little experience with assembler code of any kind, yet as a dev, and with the way you explained it, it was actually fairly comprehensive and mirrors a lot of typical high-level debugging, except you're dealing with unknown source code. I am likely not going to use what you demonstrated here any time soon, but knowing it is an option, and a path I could take if I feel dedicated to a goal, is very cool and exciting.

[dracenmarx]

It was very entertaining to watch! Just one improvement suggestion: It would be good to name variables, functions and memory addresses in the moment you identify them. Then the code browsing in Ghidra is much easier.

[Eirenband]

What a great video. So far this is the only RE video I've come across that showed a full and concise analysis with a working patch at the end.

[naveenjkondeti]

Nice, Always wanted to get into reverse engineering. Seems like starting with videogames could be fun way to start..

[govnaizmesare]

Great video! Would like to see more content like this. There's one small mistake however, the GetSystemMetrics is passed a hex value in the Ghidra overview, so instead of 20 and 21 it should be 32 and 33, which relates to the thickness of the window border and not the arrows.

[JeremyKingTech]

Great stuff! Thanks for the video! I've been on a journey to learn RE for a project and your guide has been super helpful demonstrating logic/workflow to deduce functions. Cheers!

[toweri_li]

The first time I am watching how an executable is debugged / patched on Windows - as opposed to Commodore 64 ROM in late 80's - and I actually understood this!
This speaks volumes on your capability to explain a fairly complex process to a 100% genuine noob in undestandable way!
Go ahead, pat yourself on the back. You truly deserve it! :)

[michaelhoefler]

Really really great content! I hope to see more in the future! Love the clear explanations

[TakadoGaming]

I'm really glad I found your channel! Looking forward to more sometime soon!

[jeFFFalltrades]

Hey everyone and thanks so much for watching and for all of the great feedback!

Please be sure to check out some of the other comments for tips, resources, and submitted feedback.

I hope you enjoy!

[padraiglogue]

Exceptionally high quality videos you're making here, you have a knack for teaching clearly! I'd love to see you run through some windows kernel exploits. Time to binge watch the rest of your channel

[steventwigg]

The intro montage of Roller Coaster Tycoon deserves an award.

[valhalla_dev]

Fantastic content buddy, I learned a ton about the mentality/methodology as well as the practical manner that patches are applied.

[jmikhailov]

Thank you for keeping the threshold of content's quality so high

[nola_]

Thank you for this educational video! I really learned a lot from it. You explained it well and kept pointing out your mistakes, which is essential for a good understanding (especially for beginners like me). I would really like to see more on patching/cracking games.

[username]

Very useful video, a valuable resource for sure, I was surprised to see it was the only video in the channel.