Real-world Decompilation with IDA Pro - Part 4: Cracking the Database
Channel: Adam M.
Date: 2013-09-26

This video is part 4 of a short series of tutorials to show how you can get started reverse engineering a large, real-world program by decompiling it with IDA Pro and the Hex-Rays decompiler (both from https://www.hex-rays.com/). (This video primarily uses Hex Workshop from http://www.hexworkshop.com.) It was created because all of the tutorials I've seen have used trivial examples that don't have the challenges of working with a real program. The program decompiled is the game Capitalism 2.

In this video, we use a hex editor to decipher the format of the game database in preparation for decompiling the code used to load and represent the database in-game. This is important because the data structures from the game database are surely used throughout the game.

Themes discussed:
* Locating program data files
* Deciphering data files with a hex editor

This video is best viewed full screen at 720p (HD) resolution. This tutorial assumes that you know how to program in C and that you know the basics of assembly programming as well.

I'm not an expert in reverse engineering, just a curious amateur. If you have tips on ways I can do things more easily, please let me know!

http://www.enlight.com/capitalism2/ -- Capitalism 2
http://www.adammil.net/files/115/kit.zip -- Files you can use to follow along if you don't have Capitalism 2
http://www.adammil.net/blog/v112_Reverse_Engineering_Capitalism_2.html -- Some internal information about Capitalism 2, including the database format discussed in this video
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx -- SysInternals Process Monitor (procmon)