[question] MVE library symbols

[nukeykt]

hi, Just wanted to ask how did you obtain symbols for the mve library? Basically I want to reverse-engineer mve library from other dos game: redneck rampage rides again. Thanks

[klei1984]

Hello,

REDINT.MVE from Rides Again uses the same opcodes as MAX 1 & MAX 2 MVE videos. Thus the player in this repository can play back Redneck videos too. The source code in this repository is licensed under MIT license so you can use it as you see fit.

The MVE player assembly module (mvelibwa.asm), implementing most decoder opcodes, and the C module (mvelib32.c) responsible for chunk parsing, audio video synchronization, subtitle rendering and such are taken from Fallout 2's map editor, called mapper2.exe, which contains Watcom C/C++ compiler DWARF format debug symbols that you can obtain using OpenWatcom compiler tools like wdis or wdump. The DWARF format is not compatible with GCC nor IDA.

Another source is the MacOS releases of Fallout 1 and Fallout 2 that bundle all public MVE symbols too.

Please keep in mind that the original MVE libraries in Redneck, MAX and Fallout games use self modifying assembly code, which is not portable to non x86 based architectures, nor compatible with GCC compiler generated opcodes, so I do not recommend to reengineer the same library yet again from scratch... the work is already done here... just take the already reengineered decoders and the chunk parser state machines from here at least as inspiration and hook them up to your own video and audio backends.

The subtitle renderer from mapper2 is not implemented yet in M.A.X. Port.

Please keep in mind that the MVE libraries in Redneck and MAX embedded the S.O.S Sound Operating System library from HMI that relied on interrupts and HW timers and such stuff. So unless you target MS-DOS, you must port the sound playback of MVE videos to a different architecture. The one you can find in this repository is called miniaudio which could use SDL2 audio and many more backends if you want.

Hope this helps. If it does, please close the ticket.

[nukeykt]

thanks,

my goal is to make matching decompilation of redneck rampage games, so plan is to completely reconstruct MVE library (excluding SOS for now) so it compiles with watcom and tasm(?) 😄

Yea, I found symbols in fallout games but obviosly they don't cover DOS/VESA/SOS related functions. mapper2.exe symbols also don't have symbols for C module of MVE for some reason, but has for assembly module though. I also found debug symbols in virtual pool game, but seems it is earlier version of library so, a lot of functions differ too.

I mainly ask here because I was inspecting maxrun.in file found in git history, and it have symbol names that I was not able to find in other games, so I though maybe there's other games with leaked symbols that I missed.

If it is ok for you, I think I'll just pull names from maxrun.in for now.

[klei1984]

If you target MS-DOS, then what you need is Descent II instead of Fallout's mapper2. Details below.

• Watcom C/C++ runtime libraries and the bundled Tenberry's DOS/4G(W) DPMI client API symbols are taken from original Watcom 10.5 compiler libraries and partly reconstructed from actual first public release of Open Watcom compiler's source code by hand. I wrote python scripts to detect function signatures in disassembly listings too to partly automate the work. Some of my scripts can be found in my le_disasm repository I think.
• SOS 3.x/MVE 32 bit (old)/VBE 1.x (VESA) library symbols are available in many setup.exe and install.exe programs found in Interplay and Parallax games. They mostly compiled these in debug mode.
• The Descent II setup.exe program embeds the MS-DOS 32 bit MVE library, the VBE 1.1 or was it 1.2 library, and SOS 3.x library. If you did not find some of the symbols you need in mapper2.exe (Windows 32 bit PE architecture), then you will find all of those in that setup.exe. Its again Watcom DWARF format.
• The maxrun.in file symbols are auto generated by le_disasm that receives a post processed map file from my IDA database for MAX. I also made some python scripts that was able to synchronize symbols in IDA and maxrun.in.

And if you really want to rebuild for MS-DOS, then I highly recommend to set up an actual MS-DOS system, e.g. under VirtualBox, and install the exact same original Watcom compiler infrastructure that Redneck Rampage used. It is easy to identify the matching compiler version via the compiler libraries' disassembly listings that you can create using wdis or wdump from OpenWatcom. Just compare those listings to the matching functions in RA.EXE. Your best bets are v9.5b, v10.0a, v10.5 or v11.0c. For MAX development I made an MS-DOS setup with cd-rom, mouse, sound blaster drivers, all watcom compilers, norton commander and some borland stuff too but I forgot actually why...

If you use IDA Freeware as a database tool, make sure to unbind the DOS extender from RA.EXE using PMODE/W tools and analyze the unbound linear executable only otherwise you will have a lot of trouble. Le_disasm only works with unbound linear executables. You will have to set up all segments manually by hand, but you can obtain all relevant information from le_disasm or from wdump or wdis.

In the original source code distribution of Descent I, or Descent II with DOS and Windows targets, you will find useful makefile examples to build actual DOS/4GW 386 linear executables that are bound to a DOS extender.

In RR.EXE you will find many symbols for game specific functions. GF1 library functions you can also find in setup.exe and install.exe programs from Interplay. I am sure RR and RA executables share a lot of similarities.

You can find the actual SOS 3.x Watcom libraries in the Witchaven 1 & 2 source distributions on GitHub with makefiles so you could link those directly and you do not have to skip audio or reimplement those aspects at all.

Note that le_disasm (maxrun.in) is generating GNU GCC AT&T assembly format while you would need Watcom flavor.

One last thing to note is that DOS/4G(W) 1.97 is defective. Tenberry released DOS/4G 2.01 later on which fixes several memory management issues and adds some new features too I think. Alternatively you might consider other extenders like DOS32/A or PMODE/W...

[nukeykt]

Thanks 😃

I checked setup.exe from shareware version of descent II while was searching, but it didn't have debug symbols. Will check other versions then 👍

DOSBox works well enough for watcom/tasm actually and its mounting directory capability is quite convenient. Windows NT version of watcom also works just fine under modern windows heh

I have original Redneck Rampage more-or-less reconstructed, only 3 functions differs, otherwise it is byte-by-byte matching:

https://github.com/nukeykt/Redneck-Rampage-RE

This also includes Rides Again, but MVE/SOS modules are completely missing at the moment.

Redneck Rampage Rides Again seemed to use SOS v4.x. leaked corridor 8 source code has very close version, but at least one module had differences (different compiler flag).

Both versions are built using watcom 10.5

[nukeykt]

checked other versions of descent 2, still didn't find one with debug symbols. but I found something called in ENGAGE.EXE that has mve sybmols inside Descent to Undermountain cd file

[klei1984]

It is in the GOG.com Descent II setup.exe.

md5: a7e8d99619c7d5b6c34e450cf6436a65 *SETUP.EXE size: 802 783 bytes

[nukeykt]

ah, interesting, thanks 👍. I was checking CD images found on archive.org

[klei1984]

Interesting, the Descent to Undermountain Engage Net advertisement is found on the Spanish MAX retail CD-ROM, but there the executable was built in release mode. Every other files are 100% same though. Oh! Both the INSTALL.EXE and ENGAGE.EXE contain Tim Cain's GNW engine with debug symbols too 😄