search

dethrace-labs / dethrace

Reverse engineering the 1997 game "Carmageddon"
https://twitter.com/dethrace_labs
GNU General Public License v3.0
667 stars 38 forks source link

Rear view mirror in cockpit mode is not implemented #354

Closed madebr closed 2 months ago

madebr commented 8 months ago

The rear view mirror is currently disabled. Uncommenting it is not enough to get it working.

PierreMarieBaty commented 8 months ago

If someone sends me the IDA database and the executable, I am willing to look at it.

madebr commented 8 months ago

I think the issue is missing/broken functionality around BrPixelmapMatch (in brender code, and the renderer). Uncommenting the mirror code in RenderAFrame does not fix the issue.

When I implement BrPixelmapMatch, the depth buffer starts to create artifacts (asan crashes immediately), and when going in cockpit mode (when pressing C) the game crashes.

PierreMarieBaty commented 8 months ago

Indeed I see strange things in _M_br_device_pixelmap_mem_match()... unfinished reversing?

Message ID: @.***>

madebr commented 8 months ago

We did not reverse the BRender software renderer. jeff wrote a opengl based one. Its interface is not 100% correct, which might be causing an issue here.

PierreMarieBaty commented 8 months ago

Okay, I understand. I saw IDA prototypes in front of each of these functions, and stack addresses as comments of local variables, that’s why I thought it was reversing job. I suppose that was just a template and you filled the blanks.

Where did you take the specification for the BRender APIs ?

PierreMarieBaty commented 8 months ago

I’m stumped. The commented block in BRSRC13/CORE/PIXELMAP/pmmem.c lines 282-310 is typical Hex-Rays reconstruction. Why say it wasn’t reversed ? I offer to look at it and possibly fix the implementation if you send me the executable and the database file.

Also, I’ve read that the source code of BRender was made public some time ago. It might be worth a look.

PierreMarieBaty commented 8 months ago

BRender-1997/pixelmap/pmmem.c at main · foone/BRender-1997github.comLine 330 is probably what you want.

PierreMarieBaty commented 8 months ago

Sorry bad formatting.

https://github.com/foone/BRender-1997/blob/main/pixelmap/pmmem.c

Line 330 is probably what you want.

madebr commented 8 months ago

pmmem.c is for in-memory pixelmaps. I think the memory pixelmaps are not very sofisticated for getting matching buffers.

In BRender, every screen buffer is a br_pixelmap, including the screen. For an OpenGL driver, we should do magic things to get the depth buffer.

I learned recently that jeff is working on this and will release something when he's finished.

PierreMarieBaty commented 8 months ago

For information, I merged the relevant parts of the official BRender code to the dethrace brender (the concerned functions are: templateResolveNames, templateMakeMap, ValueSet, BrTokenValueSetMany, BrPixelmapMatch, _M_br_device_pixelmap_mem_match) and the result was identical. Line artefacts on the rear view mirror, leaks and crash under a few seconds on a SIGSEGV.

It seems to tell that dethrace's emulation of BrPixelmapMatch is enough for the job and that the problem is elsewhere.

(on another side, I wonder how using the official BRender code to re-create the blocky software renderer and filtering it in post-processing with hq2x would look like? Unfortunately I don't have time anymore to toy with dethrace at the moment. Back to work...)

Message ID: @.***>