don't click here

ASM Sonic CD (1993) Disassembly by Devon (and Other Things)

Discussion in 'Engineering & Reverse Engineering' started by Alex Field, Jun 9, 2022.

  1. Devon

    Devon

    La mer va embrassé moi et délivré moi lakay. Tech Member
    1,425
    1,743
    93
    your mom
    I am happy to say that disassembly work on the stage MMDs in particular will go by a **lot** quicker now, because I have written myself an auto-analysis script for IDA that can comb through an MMD file for functions, objects, Nemesis compressed data, etc. I made a tool that auto-generates a list of locations from some databases I have, and implements them into the script, as well.

     
    Last edited: Dec 31, 2022
  2. Devon

    Devon

    La mer va embrassé moi et délivré moi lakay. Tech Member
    1,425
    1,743
    93
    your mom
    This project is now considered archived. I just simply do not have the time nor the motivation to work on this anymore. Personal matters and other (personal) projects of mine are taking priority. This isn't to say that this is the end for good. Perhaps one day I may return to this. But for now, I must step away. Anyone is free to do their own work if they want to, though. The repository isn't going anywhere and can be forked. I apologize for not getting around to getting it properly cleaned up and organized like I really wanted it to be.

    I'll release some additional stuff once I get around to it. Particularly my IDA script set and hacked together Gens overlay, modified from Lapper and Mercury's Sonic 1 overlay.
     
  3. Brainulator

    Brainulator

    Regular garden-variety member Member
    If I may, I would like to know how to extract the contents of each Sonic CD build's track 01 so I can take a peek at some of the undisassembled MMDs.
     
  4. Devon

    Devon

    La mer va embrassé moi et délivré moi lakay. Tech Member
    1,425
    1,743
    93
    your mom
    It's just in ISO 9660 format. If you already have it in .iso (2048 mode), then you can open it with something like 7zip. Otherwise, if it's something like a BIN/CUE, then you'll need a different tool to open up the contents.
     
  5. Brainulator

    Brainulator

    Regular garden-variety member Member
    That puts me at a loss, since Hidden Palace's prototype releases are mainly BIN/CUE files.
     
  6. Mastered Realm

    Mastered Realm

    Member
    3,855
    573
    93
    -
    Just use a CD drive emulator like WinCD Emu.
     
  7. JayKuriN

    JayKuriN

    Defeated Dreamer Member
    Try CDMage, and open the associated CUE file. All the ISO is against a normal BIN is the ISO with some extra (garbage) sector data.

    Edit: BIN has sector data (depending on how it was burnt), not ISO.
     
    Last edited: Mar 12, 2023
  8. Devon

    Devon

    La mer va embrassé moi et délivré moi lakay. Tech Member
    1,425
    1,743
    93
    your mom
    IDA Script (use with European version)
    Gens Overlay (use with USA version)
    Extracted Data (from European version)

    Notes:
    • The Gens overlay is for the USA version, because I wanted to record videos at the NTSC rate. The others use the European version, because the wiki detailed data locations for it, so I used it.
    • To use the IDA script, open a stage MMD file in IDA, make sure that it's rooted at address 0x200000, and then run "_DisassembleMMD.idc". It will set up known functions, data, structures, and analyze object code.
    • The IDA script and Gens overlay will only work for the FINAL VERSION, not with any prototypes.
    • There MIGHT probably issues that I haven't caught, but generally, these have worked okay for me.
    • They're very much hacked together. Sorry lol
     
    Last edited: Mar 11, 2023
  9. Brainulator

    Brainulator

    Regular garden-variety member Member
    Oh, thank you!
     
  10. OrionNavattan

    OrionNavattan

    Tech Member
    175
    177
    43
    Oregon
    About how long should the script take to run? I've had it running for over an hour with no end in sight and RAM usage increasing steadily.
     
  11. Devon

    Devon

    La mer va embrassé moi et délivré moi lakay. Tech Member
    1,425
    1,743
    93
    your mom
    Which MMD file and which region?
     
  12. OrionNavattan

    OrionNavattan

    Tech Member
    175
    177
    43
    Oregon
    Tried using it with R11A EUR/PAL as a test. It analyzed about a quarter of the binary before stopping and leaking memory with no further progress.
     
  13. Devon

    Devon

    La mer va embrassé moi et délivré moi lakay. Tech Member
    1,425
    1,743
    93
    your mom
    It works okay on my end. Did you set the origin address to 0x200000 when loading the MMD file?
     
  14. OrionNavattan

    OrionNavattan

    Tech Member
    175
    177
    43
    Oregon
    I believe I did (setting it to create a ROM segment starting at 0x200000 when loading), but should the input file loading address be set to the same value?
     
  15. Devon

    Devon

    La mer va embrassé moi et délivré moi lakay. Tech Member
    1,425
    1,743
    93
    your mom
    Yes.
     
  16. OrionNavattan

    OrionNavattan

    Tech Member
    175
    177
    43
    Oregon
    Then it seems I am loading them correctly. Tried another MMD (R12C), and almost the exact same result: it works up to the end of the lost rings object before hanging.
     
  17. Devon

    Devon

    La mer va embrassé moi et délivré moi lakay. Tech Member
    1,425
    1,743
    93
    your mom
    Can you post a screenshot and maybe send your copy of R11A?

    EDIT: I did update the script to fix defining Sonic's object in Wacky Workbench. Forgot that I left that unfinished.
     
    Last edited: Mar 13, 2023
  18. OrionNavattan

    OrionNavattan

    Tech Member
    175
    177
    43
    Oregon
    The screenshot is where the script analyzes to before it stops working. Every level MMD I've tried has the same outcome.
    The only other thing I can think of is a difference in IDA or Python versions. What version of IDA are you using, and what version of Python?
     

    Attached Files:

  19. Devon

    Devon

    La mer va embrassé moi et délivré moi lakay. Tech Member
    1,425
    1,743
    93
    your mom
    Okay, I have been able to replicate the issue in 7.7. I've been using 6.8. I'll see what I can do.
     
    Last edited: Mar 13, 2023
  20. ndiddy

    ndiddy

    Member
    37
    52
    18
    You should consider updating, they added an "undo" feature in 7.3.