constants

Tool tools/triage/constants.py (program, Triage). Name the algorithms in a binary by their constants: random number generators, checksums, hashes, ciphers, compressors and well-known maths tricks.

Run it with ./gameframe run constants ARGS or python3 tools/triage/constants.py. Source on GitHub.

Its own help

This is the help text in the tool itself, as ./gameframe tool constants prints it.

Name the algorithms in a binary by their constants: random number generators, checksums,
hashes, ciphers, compressors and well-known maths tricks.

Usage: constants.py FILE [FILE ...] [--json] [--all]

Many algorithms carry numbers that appear nowhere else: the multiplier of a random number
generator, the first entries of a CRC table, the start values of a hash. Finding one in a
game's executable says which algorithm the game uses, and the address leads to the function.
That is often the fastest way to find the random number generator (re-trace, the randomiser
agent) or the decompressor of a data file (re-format).

Each 32-bit constant is searched little-endian and big-endian. For 16-bit code, where a
32-bit value is loaded as two 16-bit halves, the halves are also searched close together
(marked "split"). Tables are matched by their first few entries. A hit is a lead: open the
function at that address and confirm the algorithm before you port it. Short or common values
(such as 5381 or 65521) are left out unless --all is given. For a Windows executable the
virtual address is printed next to the file offset. Standard library only.

Named by

Skills: re-inventory, re-trace, re-format.