David Jones davidejones

X-MAS CTF 2020 Writeup: Ken Kutaragi's Secret Code

Or, How to Reverse-Engineer a PS1 Game

X-MAS CTF 2020 was my first CTF – I do ROM hacking, fan translation, and hardware modding, but I haven't done much hacking related to modern systems, so I was a wee bit worried there wouldn't be many challenges suited to my skillset. Imagine my surprise and delight, then, when I saw the challenge Ken Kutaragi's Secret Code, which consists of a PlayStation executable! And wouldn't you know it? I've hacked away at quite a few PS1 games in my day! Not many people solved it, likely because it requires quite niche skills – so let me share those with you!

Identifying our goal

The challenge description is as follows.

CUSTOM GAME ENGINES: A Small Study

A couple of weeks ago I played (and finished) A Plague Tale, a game by Asobo Studio. I was really captivated by the game, not only by the beautiful graphics but also by the story and the locations in the game. I decided to investigate a bit about the game tech and I was surprised to see it was developed with a custom engine by a relatively small studio. I know there are some companies using custom engines but it's very difficult to find a detailed market study with that kind of information curated and updated. So this article.

Nowadays lots of companies choose engines like Unreal or Unity for their games (or that's what lot of people think) because d

Get a Bot Token

As your keybase user run:

$ keybase bot token create > /tmp/bot-token

You'll get back a base64 token, like: 6C37sjCBgMNf06Z6oTgixIxHJpja8G-Qp. This is your bot token that allows you to sign up bots.

Use case : Imagine we have just created a project with composer create-project awesone-project (currently V0.2). 2 weeks later, there is a new release (V0.3). How to update your project ? Since composer update only updates the project dependencies, it is not what we are looking for. Composer doesn't know about awesome-project since it's not in our composer.json.

After trying many git solutions, I've come to this :

git archive --output=changes.zip HEAD $(git diff --name-only SHA1 SHA2 --diff-filter=ACMRTUXB)

This command will check for changes between the two commits and ignore deleted files.

	#ifdef PSXDTH
	#else
	#define PSXDTH

	//PS1 Hardware Dithering & Color Precision Truncation Function
	//by ompu co \| Sam Blye (c) 2020



	//PS1 dither table from PSYDEV SDK documentation

	"""
	Compute MD5 hashes of files in a local directory or in an S3 bucket.
	Outputs a CSV file with columns `path` and `md5`.
	When computing MD5 hashes of objects in an S3 bucket, `path` corresponds
	to the S3 URI.
	"""

	import multiprocessing as mp
	import boto3 as boto
	import pandas as pd

	-----------------------------------------------------------------------------
	PSF (Playstation Sound Format) specification v1.4
	by Neill Corlett
	-----------------------------------------------------------------------------

	Introduction
	------------

	The PSF format brings the functionality of NSF, SID, SPC, and GBS to next-
	generation consoles. PSF utilizes the original music driver code from each

	#!/bin/sh -e

	OS=${OS:-`uname`}

	if [ "$OS" = 'Darwin' ]; then
	get_touch_time() {
	date -r ${unixtime} +'%Y%m%d%H%M.%S'
	}
	else
	# default Linux

	from svgpathtools import wsvg, Line, QuadraticBezier, Path

	from freetype import Face


	def tuple_to_imag(t):
	return t[0] + t[1] * 1j


	face = Face('./Vera.ttf')

	THUG2 LZSS compression scheme (as used by the *.prx files)
	Documented by GreaseMonkey in 2017
	Document version V1
	I release this document into the public domain.

	AWWW YEAAAAH! Datz RIGHT b0!Z! We got a ... yeah whatever I'm not doing the
	ASCII art required for that kind of introduction.

	Well, they could've packed it a bit better, but hey, it took 50 minutes to
	crack so I'm not complaining, and it is at least a decent compression scheme.