Reverse engineering a VC++ video game

Question

So I know x86 machine language and C++/C language. In the last weeks I've dedicated to learn Windows internals and especially PE format. My target is retrieving the Tomb Raider The Angel of Darkness source code files. This is 3d video game released 10 years ago (2003) and written in both C and C++ language. The code was both compiled with VC++ 6.0 and Intel C++ 7.1. The files from which I'm trying to guess the inital source code are PE formated executables with included ProgramDataBase file (v2.0) with public symbols. Their names are TRAOD, TRAOD_P3 and TRAOD_P4 (excluding the file extension (.exe.PDB) as the first one is compiled with vc++ and the other ones with ic++ for respectively Pentium 3 and Pentium 4 target processors.

I was using IDA Pro to open the executables and map the PDB symbols. Then I was translating the machine instructions to their C++ equivalents and trashing them into one big cache file. Then I was using dbh.exe to map the functions into their matching source files (because the PDB files had the source line information for the public functions). But before to move to the next function I was compiling at test executable with vc++ or ic++ containing that function and then comparing the results with the original one (I mean comparing the machine code equivalent of the target function with both my test exe and the game one). But then I thought this isn't so much efficient because many other process aren't considered. I mean the PDB file holds much more information than the dbh program dumps and the PE file maybe too. In articles about the PE file format it's said that it's much simillar to the .OBJ one which files are used by the linker to produce the exe. So is it a better idea to go through the .OBJ files and then to guess the source code or just work with the exe? I read also that for producing .OBJ files from PE you need to have some symbols and I have them from the PDB file so I think this conversion is possible. Also if you have any other ideas how to decompile this game share them - I really want to achieve this.

EDIT: I'm also searching a documenation aobut the .PDB format(v2.0) and about the VC++ 6.0 produced .OBJ and .LIB files.

Answer 1

Given that you don't already have the .obj files, it doesn't make sense to try to generate the .obj files from the .exe and .pdb files and then reverse engineer the generated .obj files. If you were to do this then the .obj files wouldn't have any information in them that was not already in the .exe or .pdb files. As such, you're better off just working with the .exe and .pdb files.

As for reverse engineering the code, Hex-Rays is very helpful when trying to reverse engineer x86 code back to C/C++ source code.

Answer 2

If you purpose to reverse engineer the game is order to learn the way it was made you will most likely end up having C/C++ files recreated (at least of major components). I am afraid there is no way you can reverse something and have full understanding of internal workings without firm grip on assembly. There are several tool that could aid you in your work. There are couple of great debuggers that you could use: OllyDBG and Immunity Debugger. There is obviously Hex-Rays, which offers several product. There is IDA, which is excellent multiprocessor dissembler. IDA has 2 version: free version and commercial version. There is also Hex-Rays Decompiler

Answer 3

If you are interested in really digesting the PE format, you definitely want to have a look at the references available here: http://blog.dkbza.org/2012/08/pe-file-format-graphs.html

Those diagrams are wonderfully complete and will absolutely give you an enormous leg up when it comes to analyzing an unknown file in PE format, even if the headers have been tampered with to discourage RE.