Bilingual

Dissecting Apple's Sparse Image Format (ASIF)
a month ago
- ASIF is a new sparse disk image format for macOS 26 Tahoe, designed for virtual machines and similar to VMDK, VHDX, or QCOW2.
- The header includes fields like signature, version, directory offsets, sector count, chunk size, and metadata block offset.
- Data is organized into directories, tables, and chunk groups with bitmaps for allocation tracking, enabling sparse storage.
- Reverse engineering involved analyzing hexdumps and the diskimagescontroller binary to understand the format's structure and access algorithms.
- Reading from ASIF requires calculating table and chunk indices based on offset, chunk size, and group mappings.
- The implementation is available in dissect.hypervisor, allowing tools to parse ASIF files and extract disk and volume information.
Show HN: Decomp Academy – Learn to decompile GameCube games into matching C
a month ago
- Learn to read assembly and write C that compiles to identical bytecode for retro games.
- Progress through 264 lessons covering core C idioms, data types, pointers, structs, floats, ABI, optimization, and real decompilation examples.
- Use original compilers to grade C code byte-for-byte against actual game functions.
- Start from basics like arithmetic and loops, advancing to advanced topics like 64-bit operations and GameCube/GBA-specific patterns.
- Includes practical exercises like decompiling functions from Star Fox Adventures and mastering compiler optimizations.
Reverse-engineering Nvidia's CUDA-checkpoint for faster cold starts
15 days ago
- NVIDIA's cuda-checkpoint allows freezing a CUDA process and serializing its GPU state into host memory, later restoring it exactly as it was.
- Checkpointing involves transferring GPU state into a host-side anonymous buffer, which can be manipulated directly (e.g., modifying a GPU counter) before restoration.
- The checkpoint operation is performed by a service thread within the target process, communicating via pipes, and uses ordinary driver ioctls rather than a dedicated checkpoint syscall.
- Checkpoint and restore speeds are limited by the allocation and deallocation of staging buffers, with checkpoint copying at ~3 GiB/s and restore at ~8 GiB/s, well below PCIe bandwidth limits.
- Performance can be improved by using Transparent Huge Pages (THP) to reduce buffer zeroing costs, or by intercepting mmap calls to reuse pre-zeroed buffers, achieving up to 4x speedup.
Your 'App' Could Have Been a Webpage (so I fixed it for you)
13 days ago
- The author is frustrated by being forced to install the 'Travelbound' app for a school trip itinerary, arguing it should be a webpage instead.
- He reverse-engineers the Android app by intercepting traffic, finding it fetches JSON data from a simple URL using username and password.
- He creates a Ruby script to pull the JSON and build a better HTML page, removing ads and tracking, and hosts it with the same password.
- The author criticizes 'app culture' for being unnecessary, more expensive, and offering fewer features and accessibility than webpages.
- Comments and replies show widespread support for avoiding apps, citing privacy, storage, battery life, and accessibility concerns.
Reverse Engineering the iPod Classic's Undocumented Mikey Chip
9 days ago
- Rockbox, a volunteer-maintained firmware for iPod Classic, lacked support for Apple's earbud remote due to an undocumented chip called 'Mikey'.
- Reverse engineering efforts uncovered that the remote uses analog signals and an identification chirp, with no public documentation available.
- By sweeping the Mikey chip's registers, the author found the correct mode (0x2f) to enable button reporting and decoded events for play/pause and volume buttons.
- Hardware limitations were discovered, including a delayed button release report after inactivity, requiring software workarounds like click-only handling for the center button.
- A driver was submitted upstream to Rockbox's Gerrit (change 7677), and a prebuilt image was released for users, enabling full earbud remote functionality on iPod Classic 6G/7th gen.
- The project highlights the value of reviving abandoned hardware through community-driven reverse engineering and open-source software.
Reverse-engineering a forgotten 80s arcade game for the Taito SJ System
9 days ago
- A group of arcade enthusiasts discovered the obscure 1982 Taito game 'Adventure Canoe' on the Taito Egret II Mini, a mini arcade console with 40 pre-installed games.
- The game was largely unknown, with minimal pre-2021 mentions, and no original cabinets, PCBs, or art records existed, making it a forgotten title for nearly 40 years.
- The author borrowed the Egret II Mini to reverse-engineer it, starting with hardware inspection, finding UART ports, and analyzing boot logs, but faced limitations without soldering tools.
- By examining the console's firmware update file, the author extracted a Linux filesystem and discovered encrypted ZIP archives containing game resources and the frontend binary.
- Using Ghidra to analyze the 'game_launcher' binary, the author found a hardcoded 64-character password that decrypted the main 'egret2' binary, revealing internal logic.
- Dynamic analysis with gdb and gef on a Raspberry Pi helped locate the decryption key for 'resource1' and 'resource2' archives, allowing extraction of ROM files.
- The ROM files needed splitting to match Taito SJ hardware specifications, and MAME's source code was updated to include checksums and DIP switches for 'Adventure Canoe'.
- After building MAME with the new game added, it ran successfully, and the author also explored porting it to the Analogue Pocket using an existing FPGA core.
A Universe from Three Sectors: Recovering TradeWars 2002's Map from Its RNG Seed
8 days ago
- TradeWars 2002 universe generated by BIGBANG.EXE using a seed from the DOS clock, producing about 8.64 million possible seeds.
- Three landmark sectors (StarDock, Terra, Rylos) are enough to uniquely identify the seed and reconstruct the entire map via brute-force search.
- The map recovery relies on reversing a linear congruential generator, with exact reconstruction requiring byte-perfect knowledge of Big Bang's sequence of random calls.
- This method is effective for early DOS versions but may not apply to later branches; however, no prior public record of this specific inverse recovery exists.
- Practically obsolete but highlights how the seemingly complex map was encoded in a small amount of information (around 23 bits).

Hasty Briefsbeta

#reverse-engineering

Dissecting Apple's Sparse Image Format (ASIF)

Show HN: Decomp Academy – Learn to decompile GameCube games into matching C

Reverse-engineering Nvidia's CUDA-checkpoint for faster cold starts

Your 'App' Could Have Been a Webpage (so I fixed it for you)

Reverse Engineering the iPod Classic's Undocumented Mikey Chip

Reverse-engineering a forgotten 80s arcade game for the Taito SJ System

A Universe from Three Sectors: Recovering TradeWars 2002's Map from Its RNG Seed