top | item 41322141

(no title)

hmfrh | 1 year ago

How much work is it to figure out which sections of the executable to export?

Would it be realistic to be able to export a modern-ish (2008-2015) Win32 game into objects and then compile/link it into a full executable again with less than a few hours work?

discuss

order

boricj|1 year ago

> How much work is it to figure out which sections of the executable to export?

As long as you do not cut across a variable or a function, you can export pretty much however you want, you don't have to follow the original object file boundaries. What to export is a separate matter and requires some knowledge about the program. Having debugging symbols makes this much easier, otherwise by the time you've made the Ghidra database accurate enough for exportation you'll usually have an idea of where's what.

> Would it be realistic to be able to export a modern-ish (2008-2015) Win32 game into objects and then compile/link it into a full executable again with less than a few hours work?

About the user report in my submission, they first raised an issue in early July and by mid-August they got a fully working, functionally identical relinked executable. To be fair, the COFF exporter had a lot of bugs that needed to be fixed and the i386 analyzer needed some touch-ups, things that somebody else should hopefully won't stumble over now.

I don't know how long it would take, but unless you have debugging symbols and are really lucky it will take more than a few hours of work. A skilled reverse-engineer can probably manage to get something executing in that timeframe (even if it crashes halfway during the first loading screen), but it's one of these tasks that you won't know when it will be done until it is done.

hmfrh|1 year ago

> As long as you do not cut across a variable or a function, you can export pretty much however you want, you don't have to follow the original object file boundaries.

Would it be possible to export basically the entire program at once and then slice off individual functions one by one?

Do you have any guides/examples of the

> Decompilation projects, by splitting a program into multiple object files and reimplementing these Ship of Theseus-style

style project?