Author here: in 2015, I was playing the classic Wing Commander in DOSBox and
suddenly realized the game state fit in the 64k data segment.
Over ten years my brother and I went through a set of experiments (stop
and go, turn, communicate) while probing the memory. We uncovered
where the variables were, how to inject calls into
the game functions, and how to sync the gamestate across the
network, so we can fly the story missions together.
My favorite finding is that the camera lives in entity slot 0x3D, which is
possibly a "3D" reference by the original developers.
You can play it at https://fireflyk64.github.io/dosbox in browser. If
you own Wing Commander, drag in the installer since no game files are
hosted. If you don't, the page will load the original DOS/3Dfx version
of Vega Strike, before I open sourced it. I upscaled and redid DOS Vega
Strike art using AI, but it now has multiplayer and a similar feel.
I'll be in the lobby for the next few hours if anyone wants to fly together.
Disclosure: I also used AI for the final step to help compile for the
browser and port our TCP networking stack to WebRTC with voice and solve
a few lingering bugs.
helllllll yeah. i think it's awesome when domain experts and clever humans use AI to automate the implementation after they've designed the path through the forest. Nice work.
I definitely used AI to bring my old Vega Strike DOS game up to speed and make it work with the layout. Some of the art is better than the rest, but it did feel good to dust off the old dos game from the geocities era and write an equivalent "accelerator" in DOSBox, so that we could get 640x480 graphics in dos. The new Vega Strike is still being developed at https://www.vega-strike.org/
However, that original WC-only 8+ years of figuring out how the data segment was organized and how to call original functions was all by-hand hacking.
It was indeed like cutting through a dark forest with no guide.
This reminds me of how I used to cheat at certain games back in the 8-bit olden days. You could change one thing at a time, save, then look through and see what changed on the disk. Eventually you could identify all the locations that held the values for inventory, stats, location, quest stages, NPC state, and so on. All you had to do after that was change those locations and - hopefully - you're all powered up. With the WozMon you could even find the locations in memory, sometimes, and have "free" healing spells, for instance, any time you like by popping open the monitor and just changing the values in RAM. Among people my age this is the usual way you'd get started with something resembling hacking. It seems like the author is doing the same type of thing. This is also the basis of cheats and trainers for games, action games tended to be easier and there might only be a handful of flags and variables making cheat menus practical. For RPGs the cheats came in the form of lists of locations on the disk, eventually though there were disk-based full blown character editors available for some handful of games. Also about the same time, some developers started to go to extreme lengths to keep people from cheating by tampering with their save game files. This became quite common in the industry by the 32-bit era.
EDIT: I will point out that people would often submit letters to computer magazines with the memory locations of popular games as time went on. But this could take months or a year or more, and a game might never have its secrets laid bare so I suspect a LOT of people just did it manually at home.
I remember how VtM: Bloodlines went as much as write entire voice acted lines for tutorial NPC making fun of you if you cheated in character creation.
That was, mind you, in game released prematurely with ton of bugs. They found time for that.
How I know that ? I didn't cheat knowingly. I just used the editor, couldn't make up my mind and I was going between the steps once or twice. I thought I forgot to spend some skill points, turned out when you went back to the skills screen, the ones you picked stayed but the game gave you new set of points to spend
They found the time for cheater heckling but not to make their character creator work right ;)
Wow, thanks for the fascinating bit of history! Sharing memory addresses through computer magazines sounds like a paper-based BBS, haha. I guess I'm just a Cheat Engine kid, though
Yes! I remember finding out which integer was the money in my Sim City save. And I remember when I figured out the build order list for Star Trek: Armada 2 and fixed the Borg AI to be so formidable that we'd have to play the First Contact sound track at full blast to even have a chance of winning against 3 Borg players.
By later times it seems this was tougher, I remember trying it with Ultima IX and utterly failing to locate a single relevant memory location after a solid week.
Not sure what game's save file it was, but I remember learning about big vs little endian this way. And before that, why I would suddenly get negative money if I made it too big!
Dwarf Fortress is like this too, in fact much of the game can be modded from such files. I like that, but I do understand the frustrations of the developer who not only saw their games cracked but also trained back in the day. It presaged what was to come heh.
The arms race honestly was so foolish. The era being discussed especially being pre achievements, pre internet in a lot of ways as we know it. So what if someone cheats in a ps2 game. Doesn’t hurt anyone.
And then you have to figure the devs realize you can do this and reverse engineer the entire game anyhow. Why even obfuscate it is the real question. Makes their workflow a little more awkward potentially and doesn’t do the intended thing.
I blame the nontechnical C suite. They don’t understand what I just wrote. So to them, this instead makes perfect sense. Lock it down, never mind why or if the lock works, just lock it and tell me its done. Command comes from upon high and so marches the industry and the hackers after them.
I think you could just point cheatEngine on dosbox process for finding the changed regions. Tho that has problem of not finding the offset from actual memory start, but once you have it you can just compare it to dump
I did a similar approach but completely without DOSBOX to get native ARM64 binaries on a Mac (using SDL3) or WASM (using canvas + HTML Audio): https://github.com/haraldF/wc-decomp - multiplayer is still very basic, though.
I think we could target both Privateer (have it so that when your ship shows up at the same nav point as another you spawn the other player) or the x-wing and tie-fighter series.
One problem I'm noticing is that people are much more interested in one-click play (which means using the Open Source RetroVega space game, which I checked in at https://github.com/danielrh/wcmulti/tree/master/retrovega ) rather than going through the trouble to dig up the installer and get the full year 1990 retro experience with Wing Commander. I worry that making older games work is not worth the time it takes if no one tries it.
Incredible. Honestly tweaking old games is one of my favorite things to do with AI. I've been having a huge go at Captain Claw, one of my favorite games from childhood. Thanks for sharing this. :)
Thanks for the feedback! I'll have a look. I do worry about congestion coupling since it would mean a bursty voice stream could affect game packets. Keeping it on a different stream allows game data priority over voice.
Author here: in 2015, I was playing the classic Wing Commander in DOSBox and suddenly realized the game state fit in the 64k data segment.
Over ten years my brother and I went through a set of experiments (stop and go, turn, communicate) while probing the memory. We uncovered where the variables were, how to inject calls into the game functions, and how to sync the gamestate across the network, so we can fly the story missions together.
My favorite finding is that the camera lives in entity slot 0x3D, which is possibly a "3D" reference by the original developers.
You can play it at https://fireflyk64.github.io/dosbox in browser. If you own Wing Commander, drag in the installer since no game files are hosted. If you don't, the page will load the original DOS/3Dfx version of Vega Strike, before I open sourced it. I upscaled and redid DOS Vega Strike art using AI, but it now has multiplayer and a similar feel.
I'll be in the lobby for the next few hours if anyone wants to fly together.
Disclosure: I also used AI for the final step to help compile for the browser and port our TCP networking stack to WebRTC with voice and solve a few lingering bugs.
I don't know if I'm more impressed with the result, or that you kept coming back to it for a decade. Super cool!
If you start today with AI assistance, how long will it take?
helllllll yeah. i think it's awesome when domain experts and clever humans use AI to automate the implementation after they've designed the path through the forest. Nice work.
I definitely used AI to bring my old Vega Strike DOS game up to speed and make it work with the layout. Some of the art is better than the rest, but it did feel good to dust off the old dos game from the geocities era and write an equivalent "accelerator" in DOSBox, so that we could get 640x480 graphics in dos. The new Vega Strike is still being developed at https://www.vega-strike.org/
However, that original WC-only 8+ years of figuring out how the data segment was organized and how to call original functions was all by-hand hacking. It was indeed like cutting through a dark forest with no guide.
You write well.
This reminds me of how I used to cheat at certain games back in the 8-bit olden days. You could change one thing at a time, save, then look through and see what changed on the disk. Eventually you could identify all the locations that held the values for inventory, stats, location, quest stages, NPC state, and so on. All you had to do after that was change those locations and - hopefully - you're all powered up. With the WozMon you could even find the locations in memory, sometimes, and have "free" healing spells, for instance, any time you like by popping open the monitor and just changing the values in RAM. Among people my age this is the usual way you'd get started with something resembling hacking. It seems like the author is doing the same type of thing. This is also the basis of cheats and trainers for games, action games tended to be easier and there might only be a handful of flags and variables making cheat menus practical. For RPGs the cheats came in the form of lists of locations on the disk, eventually though there were disk-based full blown character editors available for some handful of games. Also about the same time, some developers started to go to extreme lengths to keep people from cheating by tampering with their save game files. This became quite common in the industry by the 32-bit era.
EDIT: I will point out that people would often submit letters to computer magazines with the memory locations of popular games as time went on. But this could take months or a year or more, and a game might never have its secrets laid bare so I suspect a LOT of people just did it manually at home.
I remember how VtM: Bloodlines went as much as write entire voice acted lines for tutorial NPC making fun of you if you cheated in character creation.
That was, mind you, in game released prematurely with ton of bugs. They found time for that.
How I know that ? I didn't cheat knowingly. I just used the editor, couldn't make up my mind and I was going between the steps once or twice. I thought I forgot to spend some skill points, turned out when you went back to the skills screen, the ones you picked stayed but the game gave you new set of points to spend
They found the time for cheater heckling but not to make their character creator work right ;)
> With the WozMon you could even find the locations in memory
Never heard of WozMon before. I was a happy Game Wizard user :D
https://web.archive.org/web/19970119194137/http://www.gwiz.c...
Wow, thanks for the fascinating bit of history! Sharing memory addresses through computer magazines sounds like a paper-based BBS, haha. I guess I'm just a Cheat Engine kid, though
Yes! I remember finding out which integer was the money in my Sim City save. And I remember when I figured out the build order list for Star Trek: Armada 2 and fixed the Borg AI to be so formidable that we'd have to play the First Contact sound track at full blast to even have a chance of winning against 3 Borg players.
By later times it seems this was tougher, I remember trying it with Ultima IX and utterly failing to locate a single relevant memory location after a solid week.
Not sure what game's save file it was, but I remember learning about big vs little endian this way. And before that, why I would suddenly get negative money if I made it too big!
Ya especially with DRM or multiplayer lockdown measures.
But there is still a revolution where most game files are JSON or plain text (like that build list from Star Trek Armada 2).
Dwarf Fortress is like this too, in fact much of the game can be modded from such files. I like that, but I do understand the frustrations of the developer who not only saw their games cracked but also trained back in the day. It presaged what was to come heh.
The arms race honestly was so foolish. The era being discussed especially being pre achievements, pre internet in a lot of ways as we know it. So what if someone cheats in a ps2 game. Doesn’t hurt anyone.
And then you have to figure the devs realize you can do this and reverse engineer the entire game anyhow. Why even obfuscate it is the real question. Makes their workflow a little more awkward potentially and doesn’t do the intended thing.
I blame the nontechnical C suite. They don’t understand what I just wrote. So to them, this instead makes perfect sense. Lock it down, never mind why or if the lock works, just lock it and tell me its done. Command comes from upon high and so marches the industry and the hackers after them.
These are the sorts of posts I come to Hacker News for.
What a brilliantly fun project to share with the world. Thank you to the authors.
I think you could just point cheatEngine on dosbox process for finding the changed regions. Tho that has problem of not finding the offset from actual memory start, but once you have it you can just compare it to dump
I did a similar approach but completely without DOSBOX to get native ARM64 binaries on a Mac (using SDL3) or WASM (using canvas + HTML Audio): https://github.com/haraldF/wc-decomp - multiplayer is still very basic, though.
Wow, that's amazing.
Could this approach be used to make a similar game? It looks like a lot of fun—thanks for sharing!
I think we could target both Privateer (have it so that when your ship shows up at the same nav point as another you spawn the other player) or the x-wing and tie-fighter series.
One problem I'm noticing is that people are much more interested in one-click play (which means using the Open Source RetroVega space game, which I checked in at https://github.com/danielrh/wcmulti/tree/master/retrovega ) rather than going through the trouble to dig up the installer and get the full year 1990 retro experience with Wing Commander. I worry that making older games work is not worth the time it takes if no one tries it.
Incredible. Honestly tweaking old games is one of my favorite things to do with AI. I've been having a huge go at Captain Claw, one of my favorite games from childhood. Thanks for sharing this. :)
Neat! You're using the data channel for voice? why not the rtc stream?
Thanks for the feedback! I'll have a look. I do worry about congestion coupling since it would mean a bursty voice stream could affect game packets. Keeping it on a different stream allows game data priority over voice.
Oh man. Blast from the past. I loved wing commander back in the day.
Really cool write up - thanks for sharing.
cool. thanks for sharing
It's just hard to trust Go again after the multipath tcp debacle.
I can port https://github.com/danielrh/lobbylink to rust if that's helpful.... probably would have the same external interface.
That was a linux kernel bug, nothing to do with Go.