Show HN: After a decade of reversing, I got co-op working in DOS Wing Commander

Posted by daniel_rh 1 day ago

Counter251Comment38OpenOriginal

Comments

Comment by daniel_rh 1 day ago

Author here: in 2015, I was playing the classic Wing Commander in DOSBox and suddenly realized the game state fit in the 64k data segment.

Over ten years my brother and I went through a set of experiments (stop and go, turn, communicate) while probing the memory. We uncovered where the variables were, how to inject calls into the game functions, and how to sync the gamestate across the network, so we can fly the story missions together.

My favorite finding is that the camera lives in entity slot 0x3D, which is possibly a "3D" reference by the original developers.

You can play it at https://fireflyk64.github.io/dosbox in browser. If you own Wing Commander, drag in the installer since no game files are hosted. If you don't, the page will load the original DOS/3Dfx version of Vega Strike, before I open sourced it. I upscaled and redid DOS Vega Strike art using AI, but it now has multiplayer and a similar feel.

I'll be in the lobby for the next few hours if anyone wants to fly together.

Disclosure: I also used AI for the final step to help compile for the browser and port our TCP networking stack to WebRTC with voice and solve a few lingering bugs.

Comment by cadr 1 day ago

I don't know if I'm more impressed with the result, or that you kept coming back to it for a decade. Super cool!

Comment by spiritplumber 16 hours ago

HI DANIEL YOU'RE AWESOME <3 <3 <3

guess what me and kuprin who met on the privateer remake forum are a couple, and i got citizenship <3

miss you!

Comment by n0th3rwcf4n2026 7 hours ago

Hey spiritplumber, that's a nick I have not seen in many years! Are you still working on any of the old models from back during the vegastrike era? I remember you prolificly produced a ton of wing commander models, I think at least some had gotten used in other projects, but then vegastrike 0.5 changed a bunch of formatting?

Anyways just wanted to say I appreciated all the work you did and thought it was cool to randomly run across you here!

Comment by frikk 1 day ago

helllllll yeah. i think it's awesome when domain experts and clever humans use AI to automate the implementation after they've designed the path through the forest. Nice work.

Comment by daniel_rh 1 day ago

I definitely used AI to bring my old Vega Strike DOS game up to speed and make it work with the layout. Some of the art is better than the rest, but it did feel good to dust off the old dos game from the geocities era and write an equivalent "accelerator" in DOSBox, so that we could get 640x480 graphics in dos. The new Vega Strike is still being developed at https://www.vega-strike.org/

However, that original WC-only 8+ years of figuring out how the data segment was organized and how to call original functions was all by-hand hacking. It was indeed like cutting through a dark forest with no guide.

Comment by 1 day ago

Comment by genxy 1 day ago

You write well.

Comment by atakmim 1 day ago

If you start today with AI assistance, how long will it take?

Comment by daniel_rh 7 hours ago

0 minutes because the entire 11 years this project has been open source on a dosbox branch; therefore, it has all been harvested in the training set, and it's a matter of requesting that the model reproduce the training set and replicate my and others' memory debugging adventures.

Comment by EmX_3000 1 day ago

This reminds me of how I used to cheat at certain games back in the 8-bit olden days. You could change one thing at a time, save, then look through and see what changed on the disk. Eventually you could identify all the locations that held the values for inventory, stats, location, quest stages, NPC state, and so on. All you had to do after that was change those locations and - hopefully - you're all powered up. With the WozMon you could even find the locations in memory, sometimes, and have "free" healing spells, for instance, any time you like by popping open the monitor and just changing the values in RAM. Among people my age this is the usual way you'd get started with something resembling hacking. It seems like the author is doing the same type of thing. This is also the basis of cheats and trainers for games, action games tended to be easier and there might only be a handful of flags and variables making cheat menus practical. For RPGs the cheats came in the form of lists of locations on the disk, eventually though there were disk-based full blown character editors available for some handful of games. Also about the same time, some developers started to go to extreme lengths to keep people from cheating by tampering with their save game files. This became quite common in the industry by the 32-bit era.

EDIT: I will point out that people would often submit letters to computer magazines with the memory locations of popular games as time went on. But this could take months or a year or more, and a game might never have its secrets laid bare so I suspect a LOT of people just did it manually at home.

Comment by photios 1 day ago

> With the WozMon you could even find the locations in memory

Never heard of WozMon before. I was a happy Game Wizard user :D

https://web.archive.org/web/19970119194137/http://www.gwiz.c...

Comment by vidarh 1 day ago

On some platforms, like the Commodore 64, this to some extent became automated with freezer cartridges: Press a "freeze" button, pick a menu option, then re-enter the game, lose a life, and press the freeze button again, and it'd look for likely locations in memory based on what had changed and presumably some heuristics.

Comment by daniel_rh 1 day ago

Yes! I remember finding out which integer was the money in my Sim City save. And I remember when I figured out the build order list for Star Trek: Armada 2 and fixed the Borg AI to be so formidable that we'd have to play the First Contact sound track at full blast to even have a chance of winning against 3 Borg players.

Comment by EmX_3000 1 day ago

By later times it seems this was tougher, I remember trying it with Ultima IX and utterly failing to locate a single relevant memory location after a solid week.

Comment by adzm 1 day ago

Not sure what game's save file it was, but I remember learning about big vs little endian this way. And before that, why I would suddenly get negative money if I made it too big!

Comment by daniel_rh 1 day ago

Ya especially with DRM or multiplayer lockdown measures.

But there is still a revolution where most game files are JSON or plain text (like that build list from Star Trek Armada 2).

Comment by EmX_3000 1 day ago

Dwarf Fortress is like this too, in fact much of the game can be modded from such files. I like that, but I do understand the frustrations of the developer who not only saw their games cracked but also trained back in the day. It presaged what was to come heh.

Comment by t3r 1 day ago

Wow, thanks for the fascinating bit of history! Sharing memory addresses through computer magazines sounds like a paper-based BBS, haha. I guess I'm just a Cheat Engine kid, though

Comment by InsidiousWombat 1 day ago

I remember how VtM: Bloodlines went as much as write entire voice acted lines for tutorial NPC making fun of you if you cheated in character creation.

That was, mind you, in game released prematurely with ton of bugs. They found time for that.

How I know that ? I didn't cheat knowingly. I just used the editor, couldn't make up my mind and I was going between the steps once or twice. I thought I forgot to spend some skill points, turned out when you went back to the skills screen, the ones you picked stayed but the game gave you new set of points to spend

They found the time for cheater heckling but not to make their character creator work right ;)

Comment by asdff 1 day ago

The arms race honestly was so foolish. The era being discussed especially being pre achievements, pre internet in a lot of ways as we know it. So what if someone cheats in a ps2 game. Doesn’t hurt anyone.

And then you have to figure the devs realize you can do this and reverse engineer the entire game anyhow. Why even obfuscate it is the real question. Makes their workflow a little more awkward potentially and doesn’t do the intended thing.

I blame the nontechnical C suite. They don’t understand what I just wrote. So to them, this instead makes perfect sense. Lock it down, never mind why or if the lock works, just lock it and tell me its done. Command comes from upon high and so marches the industry and the hackers after them.

Comment by smolder 1 day ago

Back in the early days of video games, it was rare for people to actually beat one. The difficulty was inflated to create long term interest. You didn't just play things from start to finish and watch cinematics while pressing a button occasionally. Playing a game was about mastering it.

So, to game developers in the less-early-but-still-early days, letting people cheat their way through even a single player game was a danger in that it took away the prestige of actually succeeding by normal means. It was a shameful thing to do despite the triviality. To them, getting a high score or completing a game was serious business, and cheating deserved countermeasures. Nowadays people openly cheat in competitive games where it DOES impact other people, with no remorse. I would prefer the extreme where all cheating is treated like crime over the opposite where people are proud of their ability to install an aimbot.

Comment by harry_F 1 day ago

I did a similar approach but completely without DOSBOX to get native ARM64 binaries on a Mac (using SDL3) or WASM (using canvas + HTML Audio): https://github.com/haraldF/wc-decomp - multiplayer is still very basic, though.

Comment by daniel_rh 20 hours ago

I love what you've done. I see your multiplayer is on a lan with UDP. Would you mind looking into lobbylink ? Lobbylink uses webRTC to punch through firewalls and send both reliable and unreliable packets. It works with nearly every language on every platform. The server side is completely game-independent and feel free to use the same server I do for your game lobby if you want. If you need help getting started you can file an issue at https://github.com/danielrh/lobbylink or direct message me

Comment by herodoturtle 1 day ago

These are the sorts of posts I come to Hacker News for.

What a brilliantly fun project to share with the world. Thank you to the authors.

Comment by InsidiousWombat 1 day ago

I think you could just point cheatEngine on dosbox process for finding the changed regions. Tho that has problem of not finding the offset from actual memory start, but once you have it you can just compare it to dump

Comment by JeppyG 1 day ago

Incredible. Honestly tweaking old games is one of my favorite things to do with AI. I've been having a huge go at Captain Claw, one of my favorite games from childhood. Thanks for sharing this. :)

Comment by ShakataGaNai 1 day ago

Oh man. Blast from the past. I loved wing commander back in the day.

Comment by dond1986 1 day ago

Could this approach be used to make a similar game? It looks like a lot of fun—thanks for sharing!

Comment by daniel_rh 1 day ago

I think we could target both Privateer (have it so that when your ship shows up at the same nav point as another you spawn the other player) or the x-wing and tie-fighter series.

One problem I'm noticing is that people are much more interested in one-click play (which means using the Open Source RetroVega space game, which I checked in at https://github.com/danielrh/wcmulti/tree/master/retrovega ) rather than going through the trouble to dig up the installer and get the full year 1990 retro experience with Wing Commander. I worry that making older games work is not worth the time it takes if no one tries it.

Comment by Tepix 1 day ago

Neat! You're using the data channel for voice? why not the rtc stream?

Comment by daniel_rh 1 day ago

Thanks for the feedback! I'll have a look. I do worry about congestion coupling since it would mean a bursty voice stream could affect game packets. Keeping it on a different stream allows game data priority over voice.

Comment by abrookewood 1 day ago

Really cool write up - thanks for sharing.

Comment by nnnlog 1 day ago

Wow, that's amazing.

Comment by xjlin0 16 hours ago

Hmmm, wait, what? And why Tanaka Mariko die?

Comment by 0xmattclark 1 day ago

[flagged]

Comment by shopcutout 1 day ago

[dead]

Comment by AmazingEveryDay 1 day ago

It's just hard to trust Go again after the multipath tcp debacle.

Comment by daniel_rh 1 day ago

I can port https://github.com/danielrh/lobbylink to rust if that's helpful.... probably would have the same external interface.

Comment by terminalcommand 1 day ago

That was a linux kernel bug, nothing to do with Go.

Comment by alexandrustanci 1 day ago

cool. thanks for sharing