Tuesday, October 22, 2013

Reverse Engineering Unity Games

Hi. Today I will be writing about my efforts regarding reverse engineering unity games. As you may have read in a previous post, I have recently lost all my project files in a horrific idiot hard drive reformatting disaster. I was able to get my final builds back from some people I had sent it to... and actually, it just occurred to me yesterday that I had sent Unity QA a repro project for echobox that had almost all of the final source in it (except for the visualization portions and the level design), but they have yet to reply about sending me the project.

A bug or a feature?

So it turns out that reverse engineering Unity games is actually quite possible, and even somewhat easy. Is this a feature or a bug? In my case, I have a legitimate reason to reverse engineer as much code as possible from my game executables, because it will save me a ton of work trying to rebuild what I've lost. For others, I imagine this is somewhat of a headache. There is an extensive forum post about this, but that's mostly useful for back up information.

There are two tools that I used in the reverse engineering process:
A sketchy Unity asset unpacker, and .NET Reflector. The asset unpacker just takes your sharedassets0.assets file and spits out all the files in it, which is for the most part undecipherable garbage, but some of it is helpful. .NET Reflector is a magical program written by timeless space wizards that takes .NET assemblies and turns them into C# code.

So there are a few major categories of assets in a unity project that one might want to recover:
  • Art/models
  • Scenes, gameobjects, and prefabs
  • Scripts
  • Shaders
  • Compute shaders
  • Other things?
I will discuss each of these and their recoverabilities.

Art and Models

Echobox didn't actually have any custom models made for it, everything in the level is made from primitives and megafiers (a procedural mesh modification plug-in), so I didn't import any mesh assets. The same is true for textures. The asset unpacker supposedly will recover models and textures, but unity converts them to a weird format. I would rate texture recovery to be about 4 reindeer skulls (the arbitrary unit of measurement for asset recoverability), and models to be 3 reindeer skulls.

Scenes, gameobjects, and prefabs

Nope, as far as I can tell, there is no way to get this stuff back. The asset unpacker exports a lot of stuff which may or may not be prefabs, but they aren't named, and most of them are actually empty files, so I have no idea how to get back any of these things. Zero reindeer skulls.


Ding ding ding. You can get these back! The .NET Reflector allows you to pretty much get all your script source code back. There is some compiler garbage left in for things like coroutines and also some weird stuff for structs, but otherwise, you get all your code. Class variables even keep their names, local variables get renamed to things like vector1, vector2, float1. If you understand the general structure of your code, this is by far the most recoverable portion of your project. I suppose that if you didn't write it in C#, it might be harder, but whatever. 32 reindeer skulls.


Shaders come out of the asset unpacker, and they are actually not garbage, kind of. They have the usual unity shaderlab stuff about passes, subshaders, blending types and stuff, and then it's followed by a big string that looks like "aalkjapsaaaaajajaaakaalbbaaabacaaaaaaaaacbacbaaa..." for about 100 lines. I expect that this is the gpu/dx11 bytecode for your shader. This might be a little bit different for other platforms, or Unity in non-dx11/hlsl mode, so I don't know. The shader will actually work in Unity, I think, but you can't really make changes to it. I don't know how to reverse engineer the bytecode, and I can't even find a resource on what the big string actually is. It is valid ASCII, so I don't think that it's actually bytecode, or you'd get a lot of garbage too, so there is something going on here. I don't know. I bet Aras would know. I don't know if Unity can officially condone or support reverse engineering, even if it's for legitimate purposes. "aaaabbabaacaacabaccaaa" reindeer skulls.

Compute shaders

These don't even show up in the assets? I don't know where they're included in a unity project. I've dug through the binaries, and didn't even see words that would correspond to important things that are in compute shaders. So they must be compiled somewhere in a way that makes them something. Zero reindeer skulls.

Other Things?

Animations, mecanim state machines, terrains, sounds, I don't know, because none of these things showed up in the unity assets unpacker in any identifiable way. And also I didn't actually have any mecanims,  terrains or sound files in my game. ?? reindeer skulls.

Hyper Echobox recovery progress

I'm at about 60% now. Here's the github, you're welcome to try it out if you'd like. Propagation and raymarching are back, but voxelization of scene is not working because RWTexture writes are not supported in pixel shaders from camera drawing (I have posted some things on the forums about this). Also the visualization isn't tuned, it's just the old boring red and green again. And it's super not flexible. By that, I mean, it is hardcoded to be a certain size and also only work in a cube centered around <128,128,128>. I figure I should be ready for the presentation. A few more days and I'll have it back to where it was, at least from a technology standpoint.

Thanks for reading! Comments and questions are appreciated.

Wednesday, October 16, 2013

Bad Things Happen to Bad Things and Everything Else

Hi! Ok, so while I was trying to upgrade my PC to Windows 8.1 RC, I ended up deleting all my game project files forever! And also all my documents. Basically, I've lost about 30 hours of work on Bad Things (the last three days of the ultracrunch) and everything else from the beginning of July. Yep, that means the source for echobox is gone forever. Which is bad. As I mentioned before, I have to give a presentation on echobox and the Rift integration in about two weeks. So this is pretty terrible. Of course, the actual executables are still available for the panic build and the echobox demo. Those might prove useful for decompiling later, but I don't know if it's worth spending time figuring out how to get that information (a cursory search suggests that it is not that hard!?).

Should I give up on Bad Things?

Well, I guess the major advantage of continuing to work on Bad Things instead of starting, or resuming work on other game projects is that I've already got a bunch of people interested in Bad Things. And if I don't make Bad Things, then, obviously, it will never get made, and therefore I'll never get to play it. The whole reason I'm making this game in the first place is that it's the game that I want to play!

Some disadvantages:
  • I will have to redo about 30 hours of fairly monotonous work.
  • It is unclear to me that I will be able to solve some of the mechanical problems in the demo.
  • It is unclear to me that I will be able to find a suitable multiplayer implementation for the physics based interactions.
Keep in mind, I am just exploring options, and the default action here is to keep working on Bad Things. I'll talk a little bit about the game I was working on before.

Magenta! The Kitten Eating Ghost

Note that Magenta is actually lavender. And the squid in a box is not particularly relevant, except that there are octopi in the game. Magenta is a multiplayer action platformer about eating kittens and defeating puppies. Think of it as Castlevania, meets Megaman, meets Castle Crashers. There is lore. There is a lot of lore. In fact, I have spent probably way too much time inventing the universe in which this game takes place.

You run around, each kitten is supposed to be a unique challenge to eat. Each kitten you eat confers an ability that will sometimes help you but sometimes not really help. The attitude of the game is "neither happy nor sad" with a hefty helping of 'lomgcao' which is a word that I invented that means something like "actively not trying." The power of a ghost is proportional to its ability to be lomgcao. And there is dubstep. A ghost is planar convergence tied to the Nexus via wub. The Nexus is a large laserite crystal that is lodged in the center of ghostown.

The advantage of making Magenta! is that the mechanics are pretty much already sorted out. I mean, they're simple, the ways of interacting with things are limited to jumping, using your essential artifact (for Magenta, this is fangs, for other ghosts, this varies), and using your tongue to deal damage without wub and to also eat kittens. And to invoke a kitten. The kittens want to be eaten. The interface is the digestive system of the ghost. 

The reason I stopped working on Magenta! is that I needed something less ambitious and more well defined than Magenta. Now that Bad Things is becoming less well defined, it would be kind of fun to try and go back to working on Magenta.


I will spend the next week remaking echobox and perhaps integrating it with Hyper Rave Cube. This is necessary because I need to have some source to show off for the presentation, and also I need some time for my Ugh field to dissipate.

If you've got any thoughts on what I should do, or what you'd like to see, feel free to comment. Thanks!

Wednesday, October 2, 2013

Networking Things in Boston

Yeah! I've been doing fuel cells work again, and also Final Fantasy XIV (shhhh). So, the post today is going to be about some cool networking things in the Boston area. But first:

Feedback on the prototype

The feedback so far has been mostly Bad! Which is Good if you're trying to make a game that is Bad? or is it? I'm unsure. The feedback has been good, I mean, and that the feedback is that the game is bad. Which is totally understandable. Rami said he'd play it, but has yet to do so, or at least tell me his thoughts on it. Some interesting bits of feedback:
  • Art scale is off
  • There is no way to quit without alt-f4
  • Without reading the instructions, the game is impossible to play
  • The mouse cursor shows up while you're playing
  • Putting stuff in the reactor isn't fun
  • It's hard to tell which room is which from the map
  • There are some bugs with barrels and the megatongs and also barrels and the oxygen station
  • The oxygen station doesn't make sense to anyone, even if you do read the instructions
So that's cool, some of those things are just bugs that I need to fix, but some of them are more conceptual. Mostly the reactor thing needs to be made more fun, and also I need to think of a way to make the map room more intuitive. The oxygen system does make sense, but it just needs a better explanation. Hopefully I will be able to wrestle my willpower away from FFXIV and actually do some game dev soon, but its jaws are powerful.

The Oculus/Matrix partners Rift party thing

This was kind of weird. I don't know what the Matrix partners do, but apparently they are some cool investment thing that gave Oculus 60 million to make the king of head mounted displays. Their office is in some super high end building thing in Cambridge, and parking is free if you know the magic word. You go up to the 17th  floor and wander through these big glass sliding doors and then you're in a monochromatic color scheme conference zoo. Everything is a tasteful shade of off-white and there is a super slick desk with a secretary greeter person who asks you to sign in. After that, it's just a big island table (covered in pizza, for this event) and various places to sit. It's really weird to have an office just to have a place for conferences but I guess so.

At the event, they had two of the high-def rift prototypes (1080p panels) and trying out one of them in what seemed like the Unreal 4 demo, it was really really impressive. You can still see the pixels, but it's good enough. I mean, in the same way with the first dev-kit, you can kind of forget about the pixels, but with the high def prototype, it's even better because the pixels aren't that apparent unless you're looking for them. The demo that I saw was a snowy outside area of castle, and then inside was some lava and a mean golem guy that yells. And also you can shoot crazy GPU particle effects out of your face (as usual). Once I got to the golem thing, it growled at me and then I press some of the d-pad things and the screen tore in half and oops I broke it. But it was cool up until then!

I met a bunch of the Boston Indies guys there, and also Benjamin and Antonio. Benjamin is the guy putting together the talk on Rift development that's happening in November, and Antonio is the king of the Matrix partners who apparently decided to give all the funding to Oculus. I have his card, and supposedly there is a way to get "face time" with him so that I can do something? I mean, is my game dev thing the kind of thing that receives "seed funding" or am I just a guy trying to make a video game?
I don't know, but I haven't gotten an email from anyone regarding a big check yet. Oh, and I misheard Dave Evans about demo night at the Boston Indie Games Collective.

The Boston Indie Games Collective

Now this is super cool. The indie collective is a group of local game developers that rent out a space in a big room and they all work on games independently but can also talk to each other and get feedback on stuff and it's pretty much way better than making games in your room by yourself. It's somewhere in Cambridge and also it's hard to find unless you know the name of the place that rents the space (intrepid labs). In fact, it was fairly unlucky because I searched the first, second and third floors, and it just happened to be in the attic, suspended from the ceiling by big metal poles. I showed up for the demo night myth and well, it wasn't demo night. But that didn't matter because I had super awesome conversations with a bunch of the Boston Indies guys like Trevor, Erik, Luigi and Elliott. We talked about everything from networking code to the graphics pipeline. I saw Trevor's rhythm monkey strategy game and Erik's disco dodgeball, and also there was free beer. But I don't drink, so free ginger ale? Yeah.

I asked about getting some space so that I could work with them at the indie games collective, but unfortunately there is no availability until some of the other companies move out. Dang.

Some cool talk about Rift game dev in November

Here's the link to the eventbrite. I was asked to give a talk on echobox and the Rift integration. Apparently the idea is to invite game developers, students and faculty to show off how cool the Boston community is for game developers and also learning about game development. Benjamin said that there are even some acoustics R&D people who are interested in hearing about how I did the acoustic propagation for the echobox. Which is exciting. When I released echobox, nobody cared, which is a shame because I think some of the technology is really cool and hasn't really ever been done before in a game. So it's neat that some people are actually interested in it now. But this also means that I have to put together a presentation for it. I could talk a lot about echobox, but unfortunately they want to limit it to stuff about the Rift, and unfortunately again, the rift integration was pretty easy (except for some adjustments per-eye in the ray-marching algorithm). I think I'll figure out how to sneak in a bunch of stuff about the simulation because that is the coolest part. Though, it's only a half hour. Anyways, if you are in the Boston area on November 2nd, you should totally go and see me give a talk there!

So that's all the cool stuff that I've been going to in Boston, and if you see me around, be sure to say Hi, or bye, or something, anything really.