https://github.com/thenickdude/PetzA Here's a mod that allows the player to do debug-level stuff in the game. I have always been fascinated by this kind of stuff. Maybe I'll recreate my own small version, just to learn.

 

I'll compile a small reading list on the subject also. What's interesting is how there's vastly more resources for this than for something like digital forensics. (from what I saw)

https://www.starcubelabs.com/reverse-engineering-gba/ - I'd be interested in understanding romhacking further.

https://www.starcubelabs.com/reverse-engineering-ds/ - same but for a DS game

https://www.reddit.com/r/programming/comments/y8hb6z/wrote_a_blog_post_about_work_i_did/ - Cracking the compression algorithm for a DS game. Also people seem to like OP's writing style, I should take some notes.

https://medium.com/@valeriy.krygin/reverse-engineering-a-videogame-part-1-know-your-tools-7906f9bd0e3e some article idk I want to check it later

https://github.com/kovidomi/game-reversing - general basics

https://ssno.cc/posts/reversing-tac-1-4-2025/ - CoD anticheat analysis

https://connorjaydunn.github.io/blog/posts/denuvo-analysis/ - Denuvo Analysis. There seems to be a lot on the subject

I'd also be interested in finding material for more complex and modern games, too...

Maybe I should be putting an effort to backing up all that data in a personal library or something... Could be useful.

While trying to find a reverse engineering report to imitate, I stumbled upon these lovely malware analysis writeups. They have screenshots and everything so might be good for reference.

https://github.com/itaymigdal/malware-analysis-writeups

 

This seems decent formatting wise. https://vaktibabat.github.io/posts/Analyzing_A_Trojan_Horse/

I can imagine how much easier it's now to get into reverse engineering or get things done with tools like claude code.

Absolutely tbh

If it weren't for llm's I'd spend much more time trying to figure out what is going on

Still just Junk

If buying isn't owning then pirating isn't stealing.

Pheww, okay, so I spent the entire day digging around with the debugger and ghidra and whatnot and it caused a headache so strong you wouldn't believe it. Picrelated: my honest reaction

The problem I was trying to solve right now was trying to figure out how to enable unicode in the game. I want to use cyrillic + extended alphabet (some languages use this)

assembly&x32dbg are so hard for me to navigate now it's unreal

In the end I finally found the parser function and figured it actually reads the file by 1 byte at a time. I did not find the parser for unicode (not sure if it exists yet)

So... Basically we can only use symbols from 00 to FF now. Which is 256 symbols. Which is why it crashes when we convert translationkit.txt to utf.

What's interesting is the russian version of petz is not in unicode it's just ANSI with windows 1251 or something, I don't know the specifics, this is just how it is.

 

SO I guess we just gotta do codepage remapping now. (basically replace one letter with another) I always knew this was a thing but I really believed I could just easily enable unicode here lol. I cant even begin to imagine how arabs deal with all this localization bullshit.

 

Fuck the police

All Cops are Bastards.

First, a cool story: www.youtube.com/watch?v=JjFBaGr1xgM

A hacker reverse engineered gta5's poor loading times. The reason was that during online load the game read json for shop items, but it did it really poorly - it loaded the file again and again each read. Rockstar eventually reached out to him and granted a bounty of 10,000$. Very cool.

 

As for my project, I made some progress today. I am going to try to change the game via DLL's, ship it with a modified font and all that. I made my first ever DLL and managed to inject it, but now the hardest part begins, how the fuck do I plunge in my edited font there. Like it's probably not enough to load it so???... Honestly I expected a localization project to be much, much easier.

 

Edit: I have also been tracking down the text pipeline, yes. It's very elaborate for a simple kiddie game, but I suppose I expect no less from the team that pioneered that weird ballz artstyle of theirs. I actually love it. I think engineering wise petz 5 is quite cool, (hell according to other modders it has some sort of genetics system) it's just that it's a bit empty content wise.

Current progress

Feels like magic's

replaced font to impact

I STILL don't quite understand what is going on. I wanted to write a report but this would be too mentally taxing

 

Also there's a problem

Sometimes the hook function (where I replace the font) does not run at all... some caching issue perhaps?

How the Russian version is localized: it straight up uses entirely different versions of fonts, specifically Arial -> Arial_Cyr

Now, I was confused by this at first because you can't just replace a string that's too short.

So, I guess the natural assumption is this is a different build? (meaning the source code was directly modified..)

I was so mystified how they did it at first, like were they reverse engineering, but probably no.

 

I did try searching for empty 00 spaces but couldn't find them.

Also I hear apparently you can add additional PE sections with data? big if true.

Honestly I don't really get direct exe patching yet so I'd rather stick with my dll now.

for reference

Not sure how much /reverseengineering/ this is at this point, but I'm gonna add some more details about what I did yesterday.

Originally, my goal was to translate the game to a language that uses cyrillic and 4 extra letters (therefore, 8 extra symbols)

I decided to mod the original English build.

Now, Petz can only scan 1 byte at a time as I saw from researching the function that reads translationkit.exe. It processes text as 1 byte at a time. Therefore, we cannot use unicode. Seems like the program is using ANSI.

But, Windows ANSI code page has a lot of extra symbols, not just the alphabet and the numbers. (pic1) It has 256 symbols I'm pretty sure.

I decided to replace 0x80-0x88 symbols with the ones I need. Where? In a .ttf font.

But this means I would have to type these symbols to make them show up. (pic2) I guess I'll translate first and then use "search and replace". I also replaced the extended latin symbol with cyrillic.

The in-game result as follows on pic3.

Now, you can see the text is kinda fucked up, it's because ttf's have offset info for letters which I have to fucking fix now. Oh well.

I'm also a bit concerned about the exe strings but if we're using the new font it shouldn't be a problem I think... Maybe I'll skip them though idk.... or I will have to make yet another hook fuckkkkk

 

 

This also means I will have to go into detail of HOW we're going to load the .ttf into the game. I tried looking into exe editing, etc etc, but DLL seemed the easiest. But I don't understand it well enough yet so I will write a report sometime in the future.

Interestingly, I also learned a word for a phenomen that I have known ever since I was a kid. If your first language is one that doesn't use purely Latin, or perhaps if you tried running an old Japanese program, you might have encountered it before.

 

Mojibake.

https://en.wikipedia.org/wiki/Mojibake

 

Basically back in 00s and early 10s the text would end up garbled if we used the wrong encoding page. For example, here's me changing encoding from Cyrillic to Japanese.

🤔

Alright. Today I will be journaling my work again, mostly because this is the main way I can tolerate the boredom from doing things I don't quite understand and will forget about soon. I can't even listen to music in the background without writing, I don't know why. So, yes, when I write things down work feels more meaningful and engaging.

 

Let's get to it.

 

The next text I'm trying to "localize" works on HMENU. You can see it by searching "popupmenu" in Ghidra. It's likely that the rest of the text uses HMENU also.

HMENU is Windows system menu, it asks for system font and you can't replace it with a custom one. So the idea is we just try to intercept the menu creation and change text symbols on the fly.

 

LoadMenuA gets called twice during startup and during the debug it seems to cycle thru all the Goto menu items in the EDI. I did hook it and... there was nothing in the arguments related to locations. I was bretty confused, but oh well. Perhaps the names are passed through something else.

 

Now, DrawTextA in the DoWMDrawItemGotoMenu actually cycles through locations as well. Actually better yet probably all of the system level text goes through it. SO if I switch symbols here it should work out better. Maybe?

 

Writing hooks is a fucking hassle though I'll describe how it's done in the next post or whatever. All of my workflow compiling and running too I guess.

 

I feel so sleepy.

 

I still feel fascinated with Arabic text engines. Arabic in Win98 was connected too, you know! And how they did it was by also intercepting the text before drawing it, modifying it to be connected. I don't even care about anything else related to Arabs just this specific thing.

hooking drawtextA gets flagged by windows defender LOL 😂😂😂😂😂 I am going to fucking explode I need a non virusy approach

Allahu Akbar!!! 💥

Back to the ghidra mines. We're working with HMENU and it might be possible to change its font.

 

I'm not gonna write all the useless bullshit about GDI internals and just move onto something good.

 

How to hook a game function that is not documented? With Ghidra decompilation, there are some problems. The signatures are not super accurate. And you can't just rewrite the first five bytes. In my case it cut an instruction in half. Also I don't understand thiscall andfastcall and I can't get into this now.

 

I'm writing everything manually "to learn" but I barely understand anything. Minhook basically does this all automatically. It even calculates the trampoline size automatically, wonder how...

_____

Todo for future me:

1) Add a "bytes" parameter to the hook function. I will pass this manually.

2) Uhh Idk try to see the hdc internals from the WM Menu function. Hopefully I can see which font it is and then replace it, or look for where I can replace it.

Tried ApiMonitor a few days back, not bad.

Got some behemoth hpp file from someone who decided to help me out. Well it's not that big but it is 247 lines of code many of which I do not understand. That's a bit exciting, I get to learn something. They taught me how it all works more or less so I can focus on actually doing stuff.

 

Also, I wanted to take a break from hooking stuff to refactor everything, my code's a mess.. I need to separate logging from hooks, rewrite them a bit to avoid repetitive code, but maybe later.

Ohh yeah it works now

 

The guy who helped me literally decompiled the function (I think they decompiled petz completely) and I have complete control over it now technically btw.

Refactoring and coding todo:

 

1. Store the font name in one header, rn it's all over the place. I think I will have multiple variables such as:

splashScreen_font

splashText_font

briefcase_font

hmenu_font

Then we use these variables only in our hooks.

I'll have them point to the same font for now but it's very nice to keep this separate.

 

2. A separate logging module. It would be like this

[the module/function logged] time: (calling address) (parameters)

Also maybe those debugging things.

 

3. Reduce repeated code

 

4. Make paths for the dll and the fonts relative

 

5. CMake

cmake is annoying ahh but worth it

 

What I used to compile

cmake -B build -G "Visual Studio 18 2026" -A Win32

 

Add code formatting btw

 

Interesting video reverse engineering the Yandex Browser app. I'd say this is an Android reverse engineering channel focused on Russian apps, with the intent, well to advertise VPNs. Not the worst idea.

It's not in English, so I'll write the summary here.

 

The tools used:

- apktool - APK reverse engineerin tool.

- jadx - Dex to Java decompiler. Dex is basically VM bytecode.

- VSCode to read the Java code.

 

What was found:

This is pretty much all just telemetry.

 

Yandex browser asks android whether you are using a VPN via API, stores GPS geolocation, ad identificators, the closest celltower, WIFI information. It seems they're using AppFlyer, an Israeli company, whose mission is apparently to protect ad owners from wasting their money on bot farms. It can scan interfaces, system files, detect Frida and emulators.

 

Yandex Browser asks for a lot of permissions, most notably QUERY_ALL_PACKAGES. Then, it searches for specific apps on the device. The list is quite huge:

1. Yandex Browser ecosystem related apps.

2. Other popular browsers.

3. Privacy-focused browsers, such as TOR, brave, duckduckgo.

4. Vendor browsers.

5. Smaller niche browsers.

6. Search engines.

7. VPNs and censorship bypass apps. Interestingly they only mention 2 of them in the list. (Hola and something called "com.security.xvpn.z35kb")

8. Crypto, finances. (Metamask, cryptotab, kz.homecredit)

9. Utils, launchers, other various stuff.

 

Yandex browser then analyses the apps for something called "Suspicious permissions" and stores this data.

 

Now, YB is not the only app like this, pretty much all Russian bigtech is. Delivery, music, social networking, messengers, etc.

 

Another interesting video:

 

Marcus says he spent most of his time analysing Telegram and it proved to be extremely tough, according to him. Perhaps not surprisingly, after all, they have a very generous bug bounty program - they are willing to pay 10k-100k for a bug.

In comparison, MAX had its private RSA key in its source code. Select infographics related to this attached.

What's also interesting there's a lot of server-side configs. The server can set whether you're allowed to enable the dev menu, gather chat metadata, alter VPN behavior, enable SDK logs for audio calls.

This could be the possible reason the MAX app was removed from app stores, basically it looks quite a bit like spyware. Then again pretty much everything is nowadays, so I'm not sure how much this matters.

 

Btw, I found this: https://github.com/user1342/Awesome-Android-Reverse-Engineering

There's even some CTF's there, wow.

lol wtf is this cover

https://web.archive.org/web/20190311194130/http://blog.ptsecurity.com/2015/07/best-reverser-write-up-analyzing.html

 

Ptsecurity seems like the Positive Technologies blog (a Russian security company)

They had a contest the goal of which was to analyze an obscure file, with lack of documentation and perhaps even support in popular decompilers. The solution is described in detail but I have a hard time understanding it for now.

 

What's interesting, they said there's demand for firmware analysis, which the contest was aiming to test. I wonder if this holds up, even though the post is a decade old already.

 

https://web.archive.org/web/20260709032114/https://beginners.re/ Seems like a good book, there's even a huge list of universities that refer to it.

I wish there was like a decompiler for the human brain. But I guess decompiling programs is the closest thing.