Reverse Engineering of data structures in games

Question

I am currently participating in a reverse code engineering seminar for my studies in informatics: games engineering and was assigned the topic about "Identifying data structures". After an extensive talk with my supervisor we both came to the conclusion that it would make sense that i combine the topic with reversing game binaries. Our deliverables are a 15 page paper and a small tool implementing the techniques we talk about in the paper. We do not necessarily need to invent a new technique.

I already did some research about reverse engineering data structures in general and came up with mostly tools that automatically reverse engineer data structures from binary execution (e.g. https://www.utdallas.edu/~zxl111930/file/Rewards_NDSS10.pdf)

Now my question is: What would be a reasonable tool to program or a technique to write about in relation to reversing data structures from video game binaries (like World of Warcraft)? Is the method mentioned in the paper above still applicable to game binaries or are there any other known techniques?

I do have some experience when it comes to reverse engineering, but i am no where near "pro"-level. I am mostly working on a Windows (x64) platform.

Answer 1

Side Note: WoW, or any comparable MMORPG, is probably a bad target for your research, because many of those feature various anti-hack, anti-cheat or anti-botting techniques, which will probably detect what you're doing.

I'm far from being an expert on this myself, but i've disassembled and tried to understand a 20 year old game as a hobby project recently. The executable has a size of 800 KB, IDA detected about 1750 functions in it, 250 of which were C/C++ library functions. Needless to say, i spent quite some time looking at various functions and checking the strings they used without understanding too much.

What brought the breakthrough for me was when i found out how the compiler handled class construction; each class constructor calls a malloc()-like function (with the size as parameter), then calls the constructor of the superclass, then initializes the methods (there is no vtable like in more modern compilers; the compiler initializes every "function pointer" individually) and class variables. Cross-referencing those malloc() calls, checking the sizes of the classes allocated, and following the chains of "constructor calls superclass constructor" immediately gave me an idea of the whole class tree and the size of each class.

Also, i got an idea of which function was a subclass method of which other function in the main class, which brought a lot of insight into the purpose of those functions, as as i knew which function was a class method of which class, it was quite easy to track the this pointer of the function, track its dereferences, and find out which class element was used as integer, double, or pointer type, and in case of pointers, know which other class type they pointed to.

This was my first exposure to IDA, so i knew nothing about its scripting capabilities and started learning about them when things became too repetitive; if i had to do the same now, i'd probably script/automate a lot of what i did manually.

I think this might even be easier with modern C++ compilers that use vtables in a predictible way; check where the vtables get assigned to find out where classes get instantiated; check the superclass-constructor calls to find out about class hierarchy; check the sizes in malloc/new calls to get structure/class sizes; track the this pointers in class methods (which are easily identified through the vtables) to find out how the elements are used. All this can be done using static analysis, so you don't even have to care much about how anti-cheat/anti-debug techniques might affect the outcome.

Answer 2

This answer is just to expand on what @Guntram Blohm has said.

This question is really way to broad to answer so, I'm going to make the assumption that your reverse engineering x86/x64 native executables on Windows (not bytecodes languages such as Java and .NET). First of let me say that this isn't a full of methods as there is so many way depending on so many things. Here is a list of potential things which would affect your reverse engineering techniques:

• Windows version (Many of the older tools only run on XP that's why I have a VM setup for XP. But not all games run on XP)
• Executable architecture (Not all debuggers are multi architectures)
• Native or bytecode language (Bytecodes can be decompiled)
• Compilers some compilers expose meta data which can be useful for reverse engineering. (You can use PEiD to work out what the executable was compiled with. Note: Packers can obfuscate what it was originally compiled using though).
• Protection such as packers or anti-cheats (Too much to answer without getting off-topic If you want to make a new question and I'll gladly answer it)

Method 1: Firstly, do your research and you may find the game engine SDK which will have all the data structures and if any slight modifications check method 2.

Method 2: If you wanted to find a particular data structure for example you wanted to find your players health. If you found your health in Cheat Engine then looked what writes to it using the Cheat Engine debugger.

Let's pretend we had this instruction write to our health value:

MOV [EAX+32], EBX

We know +32 is an offset of the data structure which holds health in there. Which you could use tool such as ReClass to aid you or structure in Cheat Engine.

Once you've done this you could change values held at each variable and see if it has a visual impact on game. If you can't manage to work it out you can set bp on all registers for the value of your base address register + offset on the complexed breakpoint conditions. Once the breakpoint is hit you'll have to step through the assembly opcodes to try work out whats the address is used for.

You may want to check the EAT for any hints for functions or data that is exposed too.

I'd recommend you get yourself the following tools:

• Cheat Engine
• IDA PRO
• PEiD
• ReClass

Answer 3

If you consider a different approach, that is statically analyze the data formats without binary execution, I suggest to have a look at this blog post describing "the methods for examining unknown binary formats that can be either a file, file fragment, or memory dump."