I don't know anything about reverse engineering, but I have wanted to reverse engineer/decompile the Disney Animation Studio [1] for DOS for years.
I found the software at a thrift store in 2009, when I was eighteen, and I was immediately impressed. This was actually very intuitive, easy-to-use animation software that was very powerful, years before FutureSplash/Flash was released.
There's not a ton of info available on the internet now, but I have been trying to remedy that a bit [2] by uploading the manual. I reached out to Disney to ask if I could potentially buy and release the source code off of them, and they politely told me "no". I reached out to the creators in the credits on LinkedIn to see if there there was any way I could look at the code or if they could at least answer some questions, and they never got back to me.
I think the only way we're going to get the source code to The Animation Studio will be if I learn how to use Ghidra (or something similar) and decompile it myself.
It isn't that hard. I'm currently reverse engineering a old flight simulator game called A-10 Cuba. I had to teach myself X86 Assembly, and understand basic calling convention. Then C++ vtables, struct alignment and struct layout. How-ever you do need this basic level understanding of the core fundamental to help you along when the tools you use IDA, Ghidra that turn the assembly code back into C pseudo code.
So there is a big hurdle to get over in the initial stages but you soon find out that a lot higher code structure/scaffold isn't wiped out by the compiler. For example, the generated assembly code very closely mirrors the C/C++ function boundaries. This enables you to infer the over-all original code structure/layout basically from the call chain, and then you can manually step through and figure out what the original programmer was trying to achieve - abet the order of execution does get messed up by the compiler but it isn't that bad.
In my project with A-10 Cuba, I was successful in reverse engineering its file format, the over-all module layout, engine and rendering engine during my three weeks break. I still have some time to work out the AI logic, and mission design but one builds on another. What do I mean one builds on another? Well when you first start you have no types, not structs. So the first days you think you're making absolutly no progress because you're trying to calculate pointer offsets and structs layouts in IDA. I highly recommend Google Gemini or Claude code to do this heavy lifting because you can get away with a lot by asking it (for this IDA Pseudocode, infer what the struct layout is and tell me what it is doing?).
The first stage of getting those first struct layout is painstaking, then you soon can branch off one strut, or struct pointer to another. This feeds back like a feed-back loop - because programmers are lazy. And you soon have a large part of the struct/code-flow layout figured out.
You then take the structs/code-flow, and pesudo code and then do a re-write in a modern C/C++ compiler until you have a working version.
Crimsonland (2003) is a top-down shooter that shipped as a stripped DirectX 8 binary with zero symbols. I decompiled it with Ghidra, validated behavior with WinDbg and Frida, and rewrote it from scratch in Python/Raylib — 46,800 lines matching the original behavior faithfully. The write-up covers static and runtime analysis, reverse engineering custom asset formats, and the full rewrite process. Code is on GitHub and it's playable now via uvx crimsonland@latest
Bravo, that’s a seriously impressive undertaking, and a great demonstration of the augmentation potential in agentic coding. There’s so much focus on replacing entry-level work it gets missed what these power tools can do in the hands of people who know what they’re doing.
10tons tends to make smaller scale games and you feel it sometimes but I've had a great time with quite a few of their other shooters too. You used to be able to get this bundle for cheap from fanatical sometimes, not sure if that is still the case. They are best known in the modern era for Tesla vs Lovecraft which doesn't show up in this bundle.
https://store.steampowered.com/bundle/428/10tons_Shooters/
There have been a few attempts to make open source versions of Crimsonland and I had a good time with Violetland
https://github.com/ooxi/violetland
As an active reverse engineer, I'm really curious how you used agetic AI for this! Did you just have them going through the code and labeling stuff? Or were they also responsible for writing the reimplementation? This overview is super interesting, I would love to see details about the pipeline itself.
There are many ghidra plugin, like GhidrAssist, you can use to connect to a LLM. They will automatically put a name on each function and variable. It is far from perfect but it is way faster than doing it by hand in my experience.
Any recommended learning materials/resources for basic binary reverse engineering? I'm imaging a resource that teaches the common tools/concepts and provides binaries in increasing complexity.
I really need to start familiarizing with these new tools, I'm only using LLMs in interactive, “question and answer”, mode and it feels like using a typewriter when everyone is switching to computer word processors.
Thanks for sharing, it's a really interesting writeup and project!
Very impressive, makes one wonder what do some companies have in private compared to public tools that we stitch together. E.g. you can combine LLMs with statical analysis/proving to get much better results.
I don't know anything about reverse engineering, but I have wanted to reverse engineer/decompile the Disney Animation Studio [1] for DOS for years.
I found the software at a thrift store in 2009, when I was eighteen, and I was immediately impressed. This was actually very intuitive, easy-to-use animation software that was very powerful, years before FutureSplash/Flash was released.
There's not a ton of info available on the internet now, but I have been trying to remedy that a bit [2] by uploading the manual. I reached out to Disney to ask if I could potentially buy and release the source code off of them, and they politely told me "no". I reached out to the creators in the credits on LinkedIn to see if there there was any way I could look at the code or if they could at least answer some questions, and they never got back to me.
I think the only way we're going to get the source code to The Animation Studio will be if I learn how to use Ghidra (or something similar) and decompile it myself.
[1] https://en.wikipedia.org/wiki/The_Animation_Studio
[2] https://archive.org/details/disney_beginner_guide_2/disney_b...
It isn't that hard. I'm currently reverse engineering a old flight simulator game called A-10 Cuba. I had to teach myself X86 Assembly, and understand basic calling convention. Then C++ vtables, struct alignment and struct layout. How-ever you do need this basic level understanding of the core fundamental to help you along when the tools you use IDA, Ghidra that turn the assembly code back into C pseudo code.
So there is a big hurdle to get over in the initial stages but you soon find out that a lot higher code structure/scaffold isn't wiped out by the compiler. For example, the generated assembly code very closely mirrors the C/C++ function boundaries. This enables you to infer the over-all original code structure/layout basically from the call chain, and then you can manually step through and figure out what the original programmer was trying to achieve - abet the order of execution does get messed up by the compiler but it isn't that bad.
In my project with A-10 Cuba, I was successful in reverse engineering its file format, the over-all module layout, engine and rendering engine during my three weeks break. I still have some time to work out the AI logic, and mission design but one builds on another. What do I mean one builds on another? Well when you first start you have no types, not structs. So the first days you think you're making absolutly no progress because you're trying to calculate pointer offsets and structs layouts in IDA. I highly recommend Google Gemini or Claude code to do this heavy lifting because you can get away with a lot by asking it (for this IDA Pseudocode, infer what the struct layout is and tell me what it is doing?).
The first stage of getting those first struct layout is painstaking, then you soon can branch off one strut, or struct pointer to another. This feeds back like a feed-back loop - because programmers are lazy. And you soon have a large part of the struct/code-flow layout figured out.
You then take the structs/code-flow, and pesudo code and then do a re-write in a modern C/C++ compiler until you have a working version.
I played A-10 Cuba a ton on an old Pentium 3. Are you doing this in a repo somewhere?
Crimsonland (2003) is a top-down shooter that shipped as a stripped DirectX 8 binary with zero symbols. I decompiled it with Ghidra, validated behavior with WinDbg and Frida, and rewrote it from scratch in Python/Raylib — 46,800 lines matching the original behavior faithfully. The write-up covers static and runtime analysis, reverse engineering custom asset formats, and the full rewrite process. Code is on GitHub and it's playable now via uvx crimsonland@latest
Very fun use of an agentic loop :). Do you have any info/data about how many tokens this ended up consuming in that time?
Bravo, that’s a seriously impressive undertaking, and a great demonstration of the augmentation potential in agentic coding. There’s so much focus on replacing entry-level work it gets missed what these power tools can do in the hands of people who know what they’re doing.
10tons tends to make smaller scale games and you feel it sometimes but I've had a great time with quite a few of their other shooters too. You used to be able to get this bundle for cheap from fanatical sometimes, not sure if that is still the case. They are best known in the modern era for Tesla vs Lovecraft which doesn't show up in this bundle. https://store.steampowered.com/bundle/428/10tons_Shooters/
There have been a few attempts to make open source versions of Crimsonland and I had a good time with Violetland https://github.com/ooxi/violetland
I'm a big fan of the old Macintosh game Bolo [0]
There used to be a Linux version but apparently it hasn't been updated to be added to or even compiled on modern Linux kernels and distros.
Someone I know tried to resurrect it a few years back but now I'm wondering if couldn't use OpenCode etc to get it up and running again.
(I did find a recent-ish clone [1] so may start with that)
0 - https://en.wikipedia.org/wiki/Bolo_(1987_video_game)
1 - https://github.com/stephank/orona
If you ever do, I’d like to try it out! I don’t game much, but I played Bolo a bit once and enjoyed it.
As an active reverse engineer, I'm really curious how you used agetic AI for this! Did you just have them going through the code and labeling stuff? Or were they also responsible for writing the reimplementation? This overview is super interesting, I would love to see details about the pipeline itself.
There are many ghidra plugin, like GhidrAssist, you can use to connect to a LLM. They will automatically put a name on each function and variable. It is far from perfect but it is way faster than doing it by hand in my experience.
get someone to demo the 1980s software MacNosy. You might be surprised.
Any recommended learning materials/resources for basic binary reverse engineering? I'm imaging a resource that teaches the common tools/concepts and provides binaries in increasing complexity.
How much did this cost with the AI usage ? What plans did you have ?
Reversing this by hand seems like it would have taken orders of magnitude longer…
But it is more fun and more of a learning experience, I think.
I still find myself wasting a few hours per year on this game since it’s on PS4/5
https://store.playstation.com/en-us/product/UP4403-PPSA02752...
I really need to start familiarizing with these new tools, I'm only using LLMs in interactive, “question and answer”, mode and it feels like using a typewriter when everyone is switching to computer word processors.
Thanks for sharing, it's a really interesting writeup and project!
Using LLM's in an "agentic loop" is indeed a game changer. Give it a try in a sandbox.
Is the idea that once you isolate a function it decompiles it and then iterates changes until either the recompiled asm matches?
Very impressive, makes one wonder what do some companies have in private compared to public tools that we stitch together. E.g. you can combine LLMs with statical analysis/proving to get much better results.