Magic.c

[gmzombie]

i think what would be really awesome is if we could get the online portion working again. but i love this too.

Also started to look at the new magic.c and it is awesome already. great job

[gmzombie]

What I've got labelled currently.

(If anyone has access to Hex Rays and could post what it comes up with for Shandalar.exe, I'd like to take a look at that eventually, too.)

as promised here is a hex rays shandalar.c that i made i used default options with just resource segment and imports segment checked. everything else is default.

[Korath]

Honestly, it would probably be easier to build something similar from scratch... but it just wouldn't be the same.

No promises, in any case.

[Korath]

Actually, a re-decompile of Magic.exe would be beneficial, too, since A) you've got a newer Hex Rays version than the one used to dump the Magic.c we've been working with, and B) there's been enough new injections, functions moved, and new cards added directly to the exe since then that I've already been bitten by the differences a couple times.

[gmzombie]

ok here it is fresh off the presses..

[Korath]

Initial analysis: The new version recognizes 112 functions that the old one doesn't. The old one recognizes 504 that the new one doesn't. (And the ones I looked at really were still there.) Besides failing completely on only 12 of the 1376 functions it recognized (compared to 207 of 1768 in the old version), the new version has a slight but noticeably improved decompilation quality, as expected.

I can't help but wonder if the newly-missing functions are missing because no calls to them were recognized. It might be worth it to replace one of the larger functions with something that just calls each of them in turn.

One significant problem is with injections that jmp out to ManalinkEx.dll - Hex Rays doesn't see the jmp back to the original address, and so doesn't decompile anything else in the function after it. (This is admittedly weird behavior to expect it to handle, though.) I don't suppose there's an option to decompile both files simultaneously? If so, it'll want ManalinkEx.dll's base address, which is 0x01000000. If not, it can probably be worked around by building an executable that calls those addresses intead of jmping to them. (It'll crash horribly if you try to run it, of course, but it should be decompilable.)

[gmzombie]

hmm im not quite sure if i can do that...about the only thing i can do is force it to allow references with different segment bases. would that work? if so i have decompiled another version here it is..

[Korath]

.

[gmzombie]

wow man this is awesome great job! i cant believe you got it down to only 4 decomp failures out of the 2642 functions. this is great.

[lujo]

It's been almost a year, and I occasionally check in here hoping to see another post in this thread and there's never any...

[Gargaroz]

Well, Korath is the only one amoung us that can read / decode ASM, so until he's back, we're pretty much stuck on this...

[gmzombie]

hopefully we see korath this year i know how real life things can take you away for a while.

[gmzombie]

this isnt really an update and i dont know if it will help at all but i have taken a copy of the original last update from mok version 8.3 before he left the first time. i dont know if it will help but it is at least there is a hex rays disassembly along with a straight copy of the ollydbg code

[Korath]

.

[gmzombie]

Nice to see this for sure. I'll have to take a look at it when I get home. Again I and everybody appreciates this.