David Jones davidejones

X-MAS CTF 2020 Writeup: Ken Kutaragi's Secret Code

Or, How to Reverse-Engineer a PS1 Game

X-MAS CTF 2020 was my first CTF – I do ROM hacking, fan translation, and hardware modding, but I haven't done much hacking related to modern systems, so I was a wee bit worried there wouldn't be many challenges suited to my skillset. Imagine my surprise and delight, then, when I saw the challenge Ken Kutaragi's Secret Code, which consists of a PlayStation executable! And wouldn't you know it? I've hacked away at quite a few PS1 games in my day! Not many people solved it, likely because it requires quite niche skills – so let me share those with you!

Identifying our goal

The challenge description is as follows.

CUSTOM GAME ENGINES: A Small Study

WARNING: Article moved to separate repo to allow users contributions: https://github.com/raysan5/custom_game_engines

A couple of weeks ago I played (and finished) A Plague Tale, a game by Asobo Studio. I was really captivated by the game, not only by the beautiful graphics but also by the story and the locations in the game. I decided to investigate a bit about the game tech and I was surprised to see it was developed with a custom engine by a relatively small studio. I know there are some companies using custom engines but it's very difficult to find a detailed market study with that kind of information curated and updated. So this article.

Nowadays lots of companies choose engines like [Unreal](https:

Get a Bot Token

As your keybase user run:

$ keybase bot token create > /tmp/bot-token

You'll get back a base64 token, like: 6C37sjCBgMNf06Z6oTgixIxHJpja8G-Qp. This is your bot token that allows you to sign up bots.

Use case : Imagine we have just created a project with composer create-project awesone-project (currently V0.2). 2 weeks later, there is a new release (V0.3). How to update your project ? Since composer update only updates the project dependencies, it is not what we are looking for. Composer doesn't know about awesome-project since it's not in our composer.json.

After trying many git solutions, I've come to this :

git archive --output=changes.zip HEAD $(git diff --name-only SHA1 SHA2 --diff-filter=ACMRTUXB)

This command will check for changes between the two commits and ignore deleted files.

	#ifdef PSXDTH
	#else
	#define PSXDTH

	//PS1 Hardware Dithering & Color Precision Truncation Function
	//by ompu co \| Sam Blye (c) 2020



	//PS1 dither table from PSYDEV SDK documentation

	"""
	Compute MD5 hashes of files in a local directory or in an S3 bucket.
	Outputs a CSV file with columns `path` and `md5`.
	When computing MD5 hashes of objects in an S3 bucket, `path` corresponds
	to the S3 URI.
	"""

	import multiprocessing as mp
	import boto3 as boto
	import pandas as pd

	-----------------------------------------------------------------------------
	PSF (Playstation Sound Format) specification v1.4
	by Neill Corlett
	-----------------------------------------------------------------------------

	Introduction
	------------

	The PSF format brings the functionality of NSF, SID, SPC, and GBS to next-
	generation consoles. PSF utilizes the original music driver code from each

	#!/bin/sh -e

	OS=${OS:-`uname`}

	if [ "$OS" = 'Darwin' ]; then
	get_touch_time() {
	date -r ${unixtime} +'%Y%m%d%H%M.%S'
	}
	else
	# default Linux

	from svgpathtools import wsvg, Line, QuadraticBezier, Path

	from freetype import Face


	def tuple_to_imag(t):
	return t[0] + t[1] * 1j


	face = Face('./Vera.ttf')

	THUG2 LZSS compression scheme (as used by the *.prx files)
	Documented by GreaseMonkey in 2017
	Document version V1
	I release this document into the public domain.

	AWWW YEAAAAH! Datz RIGHT b0!Z! We got a ... yeah whatever I'm not doing the
	ASCII art required for that kind of introduction.

	Well, they could've packed it a bit better, but hey, it took 50 minutes to
	crack so I'm not complaining, and it is at least a decent compression scheme.