[FF7 PC] Full source code reversing project?

[paul]

Would anyone be interested in a project like this: https://github.com/OpenRCT2/OpenRCT2

But for FF7 PC? Basically its a hook DLL where by each game function is slowly replaced with C/C++ until the full source of the game is obtained.
 

[Kaldarasha]

I got a similar idea. Is it possible to replace certain elements on the fly trough a other application. I'm mainly interested in a way to replace the models trough models with Wight painted meshes.

I also would love it if we could replace the menu and text boxes.

[halkun]

Once of my little achievements was to extract a partial source code list from the executable

http://wiki.qhimm.com/view/FF7/Technical/Source

Mind using that as kind of a template

There are two sides to this source. The game side and the PsyQ (driver) side. Its neat to see how it's put togeather

I have a cooler looking breakdown here ----> http://forums.qhimm.com/index.php?topic=13814.0

[Covarr]

Reverse engineering is great and I really like this idea, but if I see any links to copyrighted data such as decompiled source code, it will be deleted and warnings issued, or bans for repeat offenses. I know you're enough to know where the line is and not to cross it, Paul, but it needs said nonetheless.

[Shard]

Honestly, you're better off writing your own engine in 2016 rather than decompiling code from 1995-1996. Take advantage of new technology. This is what QGears is aiming to do, except it's not very active right now.

[ficedula]

It's not that bad an idea; in a sense, it's how Ultrasound and some other mods work (replace just this function - to change/add sound effects - leave the rest of the game intact).

Not sure I'd count on ever rewriting the whole thing that way, though.

[paul]

Honestly, you're better off writing your own engine in 2016 rather than decompiling code from 1995-1996. Take advantage of new technology. This is what QGears is aiming to do, except it's not very active right now.

This would be the best base for something like QGears though. For example when the world map functions are fully reversed then you can replace/extend it in any way you'd like. And you have a full working game. Otherwise everything has to be 100% re-implemented from day 1 to have a fully working game.

Also I'd assume by this point many people already know what a lot of functions in the exe do from all of the previous reversing work?

[ergonomy_joe]

Funny, decompiling Final Fantasy VII is what I have been doing for some times now.
The PC version I mean, and the patch version 1.02.
I succeeded in reversing most of the minigames (except condor) and most of the main systems (except battle) so far.
It's not easily readable (I use their addresses to name the functions and the global so far, and do not plan to rename them until all is done), but you can get a lot of information from it.
Since it's the most comprehensible of the lot I wanted to post the code to the roller-coaster mini game, but I guess I won't be allowed to do it here right ?
(though I don't understand why posting reversed data is less infringing than posting reversed code)

[paul]

RE: (though I don't understand why posting reversed data is less infringing than posting reversed code).

I don't know why either since reversed data is a 1:1 copy of the copyrighted data, yet the reversed code is an interpretation of machine code back to something that's more human readable. I.e asm -> c, the c you've come up with can't be covered by copyright.

What format is your data in? I assume you have real or pesudo C code of the reversed functions? My plan was to do something like the RC2 project where we patch the EXE to load a DLL. Then this DLL replaces all of the known functions with a reimplementation. Since the graphics output uses a "driver" system thats probably the easiest part. Perhaps you've already reversed this and the functions for loading resources?

If you ever use IRC you could join the qhimm channel to discuss further?

[ergonomy_joe]

I'll try to clarify a little how I do:
.I translate from disassembled code to C code by hand, function after function (they are easy to spot in the ASM code)
.I then use --what I believe is-- the compiler originaly used, Visual C++ 5.0, to create an object file
.I then use an original tool to compare this object file to FF7.EXE to spot any translation error

Here is sample, the UPDATE callback to the Coast shooting mini-game:

Code: [Select]

//coaster[UPDATE][callback]
void C_005E8E7E(struct t_aa0 *bp08) {
C_005E8D03(0, 0, 0, 1.0f);//coaster:clear buffers
//%%% check ending condition? %%%
if(D_00C3F75C * 4  > D_00C3F894 - 0x10 || D_00C3F774 == 1) {//else 005E8ECB
C_005E988B();//sound related(6)
C_005E8E0B(bp08);//to mainDispatcher for coaster
return;
}
//%%% %%%
C_005E8F9B(bp08);//coaster:next frame
C_0041A21E(bp08);//Refresh input driver?
if(C_00660EC0(0, bp08)) {//G_DRV_88:BeginScene
C_00666DA3(bp08);//calls "instance:reset"
C_00666DC0(bp08);//calls "dx_sfx:reset heaps(1)"
C_00666DDD(bp08);//reset "deferred heap"
//-- refresh without display --
while(D_00C3F6EC + 1.0f < D_00C3F6E8) {
D_009014A8 = 0;
C_005E9051(bp08);//coaster.refresh
D_00C3F6EC += 1.0f;
}
//-- refresh with display --
D_009014A8 = 1;
C_005E9051(bp08);//coaster.refresh
D_00C3F6EC += 1.0f;
//-- --
C_00660EEB(bp08);//G_DRV_8C:EndScene
}
C_005E8E06();//<empty>
}
You can find others amples on my (not very good) blog concerning decompilation: http://magnetiktank.blogspot.jp/

[paul]

Wow pretty interesting stuff!

Also:

"To give you an idea of how far I went, let's say that except for the Battle system (the biggest of all), the Condor Fort system and part of the Menu system related to the battle system, I could reverse all the executable file to C source code (some parts harder to read than others) and recompile to a runnable file. Which means that the fun starts ... now !"

So you can compile your source and get a binary that runs the game - except for battles? Seems quite extreme to go to the level of completely binary compatibility!

[DLPB_]

I need the submarine game, I'd find that very very interesting. See, from what i could tell, there is a TON of unused/dupe data in there.  And very strange goings on.  I think originally they were planning yo have 5 distinct difficulties with different time limits... but ran out of time.

[Covarr]

(though I don't understand why posting reversed data is less infringing than posting reversed code)

If you mean things like extracted/converted models, etc., we don't allow that to be posted here either.

[KnifeTheSky77]

Wow, that is really impressive. How much time has it taken you to get to this point?

Where can I look at more of this code?

This 'reversed' code is really no different than recreating the backgrounds, which are allowed. You look at it, analyse it and recreate it by your own means.

[Kaldarasha]

Wow, that is really impressive. How much time has it taken you to get to this point?

Where can I look at more of this code?

This 'reversed' code is really no different than recreating the backgrounds, which are allowed. You look at it, analyse it and recreate it by your own means.

I do agree. It is like as if you would show a part of a picture but not the picture itself. Also the code by itself doesn't run the game.

[Jaki]

.

[paul]

Yea, keep dreaming. It's never going to happen!

What isn't going to happen?

[ergonomy_joe]

If you mean things like extracted/converted models, etc., we don't allow that to be posted here either.

I understand. That will be hard to discuss reverse-engineering if I can't post some source code though. Maybe one function at a time is acceptable ?

So you can compile your source and get a binary that runs the game - except for battles? Seems quite extreme to go to the level of completely binary compatibility!

It builds fine, and it runs (I have to change two or three things in the source to make it run on Win 8 though). Funny when you think I'm using a build environment from 1997. As for the extremity, that's because it's the only way to be sure my code has the closest shape to the original source code.
It took a couple of years so far.

I need the submarine game, I'd find that very very interesting. See, from what i could tell, there is a TON of unused/dupe data in there.  And very strange goings on.  I think originally they were planning yo have 5 distinct difficulties with different time limits... but ran out of time.

This one is interesting: all the game's data (except the textures) is embedded in the source code.
What kind of "strange goings" are you referring to ?

[Kaldarasha]

the ff7 exe was freely shared by Eidos so there shouldn't be peoblem with sharing codes about it.

[paul]

ergonomy_joe do you actually plan to share your source at all? I'm quite keen to check it out and see how it runs . Ideally creating a github project?

[KnifeTheSky77]

ergonomy_joe should be able to share code that he has personally written, character for character, out of his own brain.

It is really interesting to see the logic underneath, even for the game over/insert disc. Those address-for-var names make it just a little harder to digest

[ergonomy_joe]

The conversation concerning the reversed source code has moved to private for now.
But to answer the questions:
.I would like to post my work somewhere
.I am aware of the legal issues

In the meantime I will try to update my blog with bits of code.
Especially, some of you maybe aware of the fact that the ORIGINAL EXE includes 3 different graphic drivers (Direct3D hardware accelerated, software, [broken]OpenGL) plus the option to load the driver as an external DLL. The sofware part is really interesting: it is a complete STATE OF THE ART (for 1997) sofware rendering library. I find it hard to beleive that EIDOS developped it only for the FF7 port, but I couldn't find traces of it in other games of that era. Anyway, this part of the code is really fun (mostly inlined ASM) and I'd like to make some post about it.

BTY, I might not be able to post anything during weekdays so don't blame me for not answering please

[paul]

The conversation concerning the reversed source code has moved to private for now.
But to answer the questions:
.I would like to post my work somewhere
.I am aware of the legal issues

In the meantime I will try to update my blog with bits of code.
Especially, some of you maybe aware of the fact that the ORIGINAL EXE includes 3 different graphic drivers (Direct3D hardware accelerated, software, [broken]OpenGL) plus the option to load the driver as an external DLL. The sofware part is really interesting: it is a complete STATE OF THE ART (for 1997) sofware rendering library. I find it hard to beleive that EIDOS developped it only for the FF7 port, but I couldn't find traces of it in other games of that era. Anyway, this part of the code is really fun (mostly inlined ASM) and I'd like to make some post about it.

BTY, I might not be able to post anything during weekdays so don't blame me for not answering please

I think what you've managed to achieve is pretty outstanding! Your method of verification is quite interesting too. Btw perhaps SW renderer could have been used in Tomb Raider ports?

[Kaldarasha]

Square did made the port not eidos. Eidos was chosen to publish the game because they had a name by PC players. Halkun has more info about that.

[syntax error]

Where I live its legal to rewrite c++ from assembler, because its your own work as long as you don't have been given a zip file of Squaresoft or Eidos code.

The FF VII engine is that big, that you better do it semi automatic like with
The state of the art multi platform open source decompiler:
https://github.com/uxmal/reko/