#retdec

Hello everyone.  It’s been a while.

To recap some of my previous posts about the HMAPL Project, I was trying to decompile the game’s code at one point from it’s main executable file.

Due to some complications in the code, I was never ultimately able to find any machine that exists with enough pure RAM to satisfy the optimization procedure, resulting in large, confusing, inefficient code.  However, the retdec program I was using can also use “virtual memory” which includes a “page file” stored on the hard drive.  The downside to using a page file is that it’s much slower than RAM, and also can cause all other running programs to slow down or crash.

So to solve my issues, I was able to create a Windows Server 2016 virtual machine on Google Cloud that included:

1 vCPU

52 GB Memory

2 TB Standard persistent disk

Windows Server 2016 Datacenter

Once configured, I installed the necessary retdec software, manually set the page file to a size of 1.8TB and let the program do it’s thing. I made sure not to even log in while the app was running, as even that could mess with memory usage and cause a system crash.  I instead based my readings off of the CPU/disk activity from the Google Dashboard.

It took roughly 12 days for the program to run it’s full course with optimizations, but it actually did complete successfully.

I decided to go with a python interpreter, as that should make the code overall simpler to interpret.  The code can be found on my [GitHub].

It’s worth noting that the decompiled code is not the same code that the developers would have used to create the game.  This is just a file generated using AI to interpret the executable powerpc data of the game.

Good news!

Avast has released the source code for their Retargetable Decompiler (RetDec for short).

Why am I excited about this?

Because can decompile PowerPC binaries (i.e. elf files) into a programming language (C or Python).

The main executable program in any Gamecube/Wii game is a Start.dol file, which is a variant of the elf format.  Also, the GC/Wii are both based on the PowerPC architecture.

Most decompilers will only break a game down into what’s called Assembly.  This is a type of machine code that is difficult at best to reverse-engineer.  And those that support recompiling to other programming languages typically only support the x86 architecture.

Previously, one could try RetDec online, but it had a very small limit on decompilation time (which was not enough for a file as large as the game’s main program code).  But now, I can run it on my own machine for as long as needed to run the decompilation process.

I’ve been able to successfully install RetDec and it’s dependencies.  I was then able to convert AWL’s Start.dol file into a Start.elf file using DolTool 0.3 and begin the decompilation process.

Unfortunately the decompilation failed part-way through due to not having enough memory (my laptop only has 4GB RAM).  My roommate offered to let me try on his laptop (which has 8GB), so once I’m able to try on that, I’ll post an update.

From the partial decompilation, I can tell that I’m on the right track though.  I’ve been able to find a few lines in the LLVM code that reference CLZ files and could be the key to their decompression algorithm.

@global_var_80298180.828 = constant [22 x i8] c"mainchapter%d.arc.clz\00"

…

%v4_800131f8 = call i32 @function_80238268(i32 %v2_800131f0, i32 ptrtoint ([22 x i8]* @global_var_80298180.828 to i32), i32 %v0_800131e8)

It appears that the clz file is passed through to a variable, which is them passed through some sort of function (possibly to be decompressed).

I’ll be analyzing this code as much as I can to try and figure out how the files work.

RetDec plugin for IDA (Interactive Disassembler). The plugin is compatible with the IDA 7.5+ versions. The plugin does NOT work with IDA 6.x, IDA 7.0-7.4, or freeware version of IDA 7.0. The plugin comes at both 32-bit and 64-bit address space variants (both are 64-bit binaries). I.e. it works in both ida and ida64. At the moment, it can decompile the following architectures: 32-bit: x86, arm,…