HN Explorer

Show HN: After a decade of reversing, I got co-op working in DOS Wing Commander (fireflyk64.github.io)

1 points by daniel_rh ↗ HN
In 2015, I was playing the classic Wing Commander in DOSBox and suddenly realized the game state fit in the 64k data segment.

Over ten years my brother and I went through a set of experiments (stop and go, turn, communicate) while probing the memory. We uncovered where the variables were, how to inject calls into the game functions, and how to sync the gamestate across the network, so we could fly the story missions together.

My favorite finding is that: the camera lives in entity slot 0x3D, which is possibly a "3D" reference by the original developers.

You can play it at https://fireflyk64.github.io/dosbox in browser. If you own Wing Commander, drag in the installer since no game files are hosted. If you don't, the page will load the original DOS/3Dfx version of Vega Strike, before I open sourced it. I upscaled and redid DOS Vega Strike art using AI, but it now has multiplayer and a similar feel.

I'll be in the lobby for the next few hours if anyone wants to fly together.

Disclosure: I also used AI for the final step to help compile for the browser and port our TCP networking stack to WebRTC with voice and solve a few lingering bugs.

30 comments

[ 0.22 ms ] story [ 29.7 ms ] thread
daniel_rh
Author here: in 2015, I was playing the classic Wing Commander in DOSBox and suddenly realized the game state fit in the 64k data segment.

Over ten years my brother and I went through a set of experiments (stop and go, turn, communicate) while probing the memory. We uncovered where the variables were, how to inject calls into the game functions, and how to sync the gamestate across the network, so we can fly the story missions together.

My favorite finding is that the camera lives in entity slot 0x3D, which is possibly a "3D" reference by the original developers.

You can play it at https://fireflyk64.github.io/dosbox in browser. If you own Wing Commander, drag in the installer since no game files are hosted. If you don't, the page will load the original DOS/3Dfx version of Vega Strike, before I open sourced it. I upscaled and redid DOS Vega Strike art using AI, but it now has multiplayer and a similar feel.

I'll be in the lobby for the next few hours if anyone wants to fly together.

Disclosure: I also used AI for the final step to help compile for the browser and port our TCP networking stack to WebRTC with voice and solve a few lingering bugs.

frikk
helllllll yeah. i think it's awesome when domain experts and clever humans use AI to automate the implementation after they've designed the path through the forest. Nice work.
daniel_rh
I definitely used AI to bring my old Vega Strike DOS game up to speed and make it work with the layout. Some of the art is better than the rest, but it did feel good to dust off the old dos game from the geocities era and write an equivalent "accelerator" in DOSBox, so that we could get 640x480 graphics in dos. The new Vega Strike is still being developed at https://www.vega-strike.org/

However, that original WC-only 8+ years of figuring out how the data segment was organized and how to call original functions was all by-hand hacking. It was indeed like cutting through a dark forest with no guide.

cadr
I don't know if I'm more impressed with the result, or that you kept coming back to it for a decade. Super cool!
[deleted]
(comment deleted)
genxy
You write well.
atakmim
If you start today with AI assistance, how long will it take?
AmazingEveryDay
It's just hard to trust Go again after the multipath tcp debacle.
abrookewood
Really cool write up - thanks for sharing.
ShakataGaNai
Oh man. Blast from the past. I loved wing commander back in the day.
Tepix
Neat! You're using the data channel for voice? why not the rtc stream?
daniel_rh
Thanks for the feedback! I'll have a look. I do worry about congestion coupling since it would mean a bursty voice stream could affect game packets. Keeping it on a different stream allows game data priority over voice.
JeppyG
Incredible. Honestly tweaking old games is one of my favorite things to do with AI. I've been having a huge go at Captain Claw, one of my favorite games from childhood. Thanks for sharing this. :)
EmX_3000
This reminds me of how I used to cheat at certain games back in the 8-bit olden days. You could change one thing at a time, save, then look through and see what changed on the disk. Eventually you could identify all the locations that held the values for inventory, stats, location, quest stages, NPC state, and so on. All you had to do after that was change those locations and - hopefully - you're all powered up. Among people my age this is the usual way you'd get started with something resembling hacking. It seems like the author is doing the same type of thing.
asdff
The arms race honestly was so foolish. The era being discussed especially being pre achievements, pre internet in a lot of ways as we know it. So what if someone cheats in a ps2 game. Doesn’t hurt anyone.

And then you have to figure the devs realize you can do this and reverse engineer the entire game anyhow. Why even obfuscate it is the real question. Makes their workflow a little more awkward potentially and doesn’t do the intended thing.

I blame the nontechnical C suite. They don’t understand what I just wrote. So to them, this instead makes perfect sense. Lock it down, never mind why or if the lock works, just lock it and tell me its done. Command comes from upon high and so marches the industry and the hackers after them.

smolder
Back in the early days of video games, it was rare for people to actually beat one. The difficulty was inflated to create long term interest. You didn't just play things from start to finish and watch cinematics while pressing a button occasionally. Playing a game was about mastering it.

So, to game developers in the less-early-but-still-early days, letting people cheat their way through even a single player game was a danger in that it took away the prestige of actually succeeding by normal means. It was a shameful thing to do despite the triviality. To them, getting a high score or completing a game was serious business, and cheating deserved countermeasures. Nowadays people openly cheat in competitive games where it DOES impact other people, with no remorse. I would prefer the extreme where all cheating is treated like crime over people being proud of their ability to install an aimbot.

t3r
Wow, thanks for the fascinating bit of history! Sharing memory addresses through computer magazines sounds like a paper-based BBS, haha. I guess I'm just a Cheat Engine kid, though
InsidiousWombat
I remember how VtM: Bloodlines went as much as write entire voice acted lines for tutorial NPC making fun of you if you cheated in character creation.

That was, mind you, in game released prematurely with ton of bugs. They found time for that.

How I know that ? I didn't cheat knowingly. I just used the editor, couldn't make up my mind and I was going between the steps once or twice. I thought I forgot to spend some skill points, turned out when you went back to the skills screen, the ones you picked stayed but the game gave you new set of points to spend

They found the time for cheater heckling but not to make their character creator work right ;)

vidarh
On some platforms, like the Commodore 64, this to some extent became automated with freezer cartridges: Press a "freeze" button, pick a menu option, then re-enter the game, lose a life, and press the freeze button again, and it'd look for likely locations in memory based on what had changed and presumably some heuristics.
dond1986
Could this approach be used to make a similar game? It looks like a lot of fun—thanks for sharing!
herodoturtle
These are the sorts of posts I come to Hacker News for.

What a brilliantly fun project to share with the world. Thank you to the authors.

harry_F
I did a similar approach but completely without DOSBOX to get native ARM64 binaries on a Mac (using SDL3) or WASM (using canvas + HTML Audio): https://github.com/haraldF/wc-decomp - multiplayer is still very basic, though.
daniel_rh
I love what you've done. I see your multiplayer is on a lan with UDP. Would you mind looking into lobbylink ? Lobbylink uses webRTC to punch through firewalls and send both reliable and unreliable packets. It works with nearly every language on every platform. The server side is completely game-independent and feel free to use the same server I do for your game lobby if you want. If you need help getting started you can file an issue at https://github.com/danielrh/lobbylink or direct message me
InsidiousWombat
I think you could just point cheatEngine on dosbox process for finding the changed regions. Tho that has problem of not finding the offset from actual memory start, but once you have it you can just compare it to dump
nnnlog
Wow, that's amazing.