add RNG reversal script

Lua/RNG index.lua

@@ -0,0 +1,192 @@
+-- Random Number Generator reversal script for Bizhawk
+-- original algorithm by trivial171 (rng, v2, rnginverse functions)
+-- please refer to this video: https://www.youtube.com/watch?v=-9YLCoK5K6o
+-- everything else by notwa
+
+local abs = math.abs
+local floor = math.floor
+local pow = math.pow
+
+-- Lua 5.3 is nice and precise and doesn't coerce everything into doubles.
+local precise = 0xDEADBEEF * 0x12345678 % 0x100000000 == 0x5621CA08
+
+-- constants of the LCG:
+local m = 1664525    -- 0x0019660D
+local b = 1013904223 -- 0x3C6EF35F
+local gcd = 4 -- of m and 2^32
+
+local powers = {}
+for i = 1, 32 do
+    powers[i] = floor(pow(2, i - 1))
+end
+local big32 = floor(pow(2, 32))
+
+local gamedb = {
+    -- pairs of (RNG state address, display list address):
+    -- Ocarina of Time (J) 1.0
+    ["C892BBDA3993E66BD0D56A10ECD30B1EE612210F"] = {0x105440, 0x11F290},
+    -- Ocarina of Time (U) 1.0
+    ["AD69C91157F6705E8AB06C79FE08AAD47BB57BA7"] = {0x105440, 0x11F290},
+    -- Ocarina of Time (J) 1.2
+    ["FA5F5942B27480D60243C2D52C0E93E26B9E6B86"] = {0x105A80, 0x11F958},
+    -- Ocarina of Time (U) 1.2
+    ["41B3BDC48D98C48529219919015A1AF22F5057C2"] = {0x105A80, 0x11F958},
+    -- Majora's Mask (J) 1.0
+    ["5FB2301AACBF85278AF30DCA3E4194AD48599E36"] = {0x098550, 0x1F9E28},
+    -- Majora's Mask (J) 1.1
+    ["41FDB879AB422EC158B4EAFEA69087F255EA8589"] = {0x098490, 0x1FA0D8},
+    -- Majora's Mask (U) 1.0
+    ["D6133ACE5AFAA0882CF214CF88DABA39E266C078"] = {0x097530, 0x1F9CB8},
+    -- Doubutsu no Mori (J) 1.0
+    ["E106DFF7146F72415337C96DEB14F630E1580EFB"] = {0x03C590, 0x145080},
+}
+
+local function mulmod(a, b, q)
+    if precise then return a * b % q end
+
+    -- this needs to be done because old versions of Lua
+    -- store everything as doubles. that means we have 52 bits
+    -- to work with instead of the 64 that Lua 5.3 provides.
+    local limit = 0x10000000000000
+    local halflimit = 0x4000000 -- half in terms of bits
+--  assert(abs(a) < limit)
+--  assert(abs(b) < limit)
+--  assert(abs(q) <= limit)
+
+    local L = halflimit -- shorthand
+    local a_lo = a % L
+    local a_hi = floor(a / L) % L
+    local b_lo = b % L
+    local b_hi = floor(b / L) % L
+    return (a_lo * b_lo + (a_lo * b_hi % L + a_hi * b_lo % L) % L * L) % q
+end
+
+local function powmod(b, e, m)
+    -- blatantly lifted from Wikipedia and tweaked for overflows.
+    if m == 1 then
+        return 0
+    else
+        local r = 1
+        b = b % m
+        while e > 0 do
+            if e % 2 == 1 then
+                r = mulmod(r, b, m)
+            end
+            e = floor(e / 2)
+            b = mulmod(b, b, m)
+        end
+        return r
+    end
+end
+
+local function mul32(a, b)
+    return mulmod(a, b, big32)
+end
+
+local function inv32(x)
+    -- Modular inverse of x, an odd number.
+    -- via https://lemire.me/blog/2017/09/18/computing-the-inverse-of-odd-integers/
+--  assert(x % 2, "inv32(x): x must be odd!")
+    local y = x % big32
+    for i = 1, 4 do
+        y = mul32(y, (2 - mul32(y, x)))
+    end
+    return y
+end
+
+local const = floor((m - 1) / gcd)
+local const_inv = inv32(const)
+
+local function rng(x)
+    -- The xth RNG value returned by the game.
+    -- Computable by geometric series formula:
+    -- RNG(x) = b * (m^x - 1) / (m - 1) % q
+    -- The denominator (m-1) shares a common factor of 4 with q,
+    -- so we compute the numerator mod 4q.
+    -- We divide by (m-1) by first dividing by 4,
+    -- and then multiplying by the modular inverse of the odd number (m-1)/4.
+    local temp = floor((powmod(m, x, gcd * big32) - 1) / gcd)
+    return mul32(mul32(b, temp), const_inv)
+end
+
+local function v2(a)
+    -- The 2-adic valuation of a; that is,
+    -- the largest integer v such that 2^v divides a.
+    if a == 0 then return 100 end -- a large dummy value
+    local n = a
+    local v = 0
+    while n % 2 == 0 do
+        n = floor(n / 2)
+        v = v + 1
+    end
+    return v
+end
+
+local function rnginverse(r)
+    -- Given an RNG value r, compute the unique x in range [0, 2^32)
+    -- such that RNG(x) = r. Note that x is only unique under the assumption
+    -- that the Linear Congruential Generator used has a period of 2^32.
+
+    -- Recover m^x mod 4q from algebra (inverting steps in RNG function above)
+    local q = big32 * gcd
+    local xpow = (mul32(mul32(r, const), inv32(b)) * gcd + 1) % q
+
+    local xguess = 0
+    for _, p in ipairs(powers) do -- Guess binary digits of x one by one
+        -- This technique is based on Mihai's lemma / lifting the exponent
+        local lhs = v2(powmod(m, xguess + p, q) - xpow)
+        local rhs = v2(powmod(m, xguess,     q) - xpow)
+        if lhs > rhs then
+            xguess = xguess + p
+        end
+    end
+    return xguess
+end
+
+if m == 1664525 and b == 1013904223 then
+    -- self-tests:
+    assert(inv32(m - 1) == 4211439296)
+    assert(rng(0) == 0)
+    assert(rng(1) == 1013904223)
+    assert(rng(2) == 1196435762)
+    assert(rng(3) == 3519870697)
+    assert(1 == rnginverse(1013904223))
+    assert(2 == rnginverse(1196435762))
+    assert(3 == rnginverse(3519870697))
+end
+
+-- run the remaining code when executed in Bizhawk, otherwise exit.
+if rawget(_G, "bizstring") == nil then return end
+
+local R4 = mainmemory.read_u32_be
+
+local hash = gameinfo.getromhash()
+local addrs = gamedb[hash]
+if addrs == nil then
+    print("unsupported ROM:")
+    print(hash)
+    return
+end
+
+local ind_prev = nil
+local dlist_prev = 0
+local ind_change = 0
+
+while true do
+    local seed = R4(addrs[1])
+    local dlist = R4(addrs[2])
+    local ind = rnginverse(seed)
+
+    gui.text(8,  8, ("RNG:  0x%08X"):format(seed),       nil, "topright")
+    gui.text(8, 24, ("index:  0x%08X"):format(ind),      nil, "topright")
+    gui.text(8, 40, ("delta: %+11i"):format(ind_change), nil, "topright")
+
+    if dlist ~= dlist_prev and ind_prev ~= nil then
+        ind_change = ind - ind_prev
+    end
+
+    ind_prev = ind
+    dlist_prev = dlist
+
+    emu.frameadvance()
+end

z64yaz0.new.c

@@ -0,0 +1,331 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+//version 1.0 (20050707) by shevious
+//Thanks to thakis for yaz0dec 1.0.
+
+#define lament(...) fprintf(stderr, __VA_ARGS__)
+#define error_when(cond, ...) do { \
+        if ((cond) || errno) { \
+            lament(__VA_ARGS__); \
+            lament(": %s\n", strerror(errno)); \
+            goto error; \
+        } \
+    } while (0)
+
+typedef unsigned char u8;
+
+enum {
+    max_runlen = 0xFF + 0x12
+};
+
+// simple and straight encoding scheme for Yaz0
+static long
+simpleEnc(u8 *src, int size, int pos, long *pMatchPos)
+{
+    int startPos = pos - 0x1000;
+    long numBytes = 1;
+    long matchPos = 0;
+
+    int end = size - pos;
+    // maximum runlength for 3 byte encoding
+    if (end > max_runlen)
+        end = max_runlen;
+
+    if (startPos < 0)
+        startPos = 0;
+    for (int i = startPos; i < pos; i++) {
+        int j;
+        for (j = 0; j < end; j++) {
+            if (src[i + j] != src[j + pos])
+                break;
+        }
+        if (j > numBytes) {
+            numBytes = j;
+            matchPos = i;
+        }
+    }
+
+    *pMatchPos = matchPos;
+
+    if (numBytes == 2)
+        numBytes = 1;
+
+    return numBytes;
+}
+
+// a lookahead encoding scheme for ngc Yaz0
+static long
+nintendoEnc(u8 *src, int size, int pos, long *pMatchPos)
+{
+    long numBytes = 1;
+    static long numBytes1;
+    static long matchPos;
+    static int prevFlag = 0;
+
+    // if prevFlag is set, it means that the previous position
+    // was determined by look-ahead try.
+    // so just use it. this is not the best optimization,
+    // but nintendo's choice for speed.
+    if (prevFlag == 1) {
+        *pMatchPos = matchPos;
+        prevFlag = 0;
+        return numBytes1;
+    }
+
+    prevFlag = 0;
+    numBytes = simpleEnc(src, size, pos, &matchPos);
+    *pMatchPos = matchPos;
+
+    // if this position is RLE encoded, then compare to copying 1 byte and next position(pos+1) encoding
+    if (numBytes >= 3) {
+        numBytes1 = simpleEnc(src, size, pos + 1, &matchPos);
+        // if the next position encoding is +2 longer than current position, choose it.
+        // this does not guarantee the best optimization, but fairly good optimization with speed.
+        if (numBytes1 >= numBytes + 2) {
+            numBytes = 1;
+            prevFlag = 1;
+        }
+    }
+    return numBytes;
+}
+
+static int
+encodeYaz0(u8 *src, u8 *dst, int srcSize)
+{
+    int srcPos = 0;
+    int dstPos = 0;
+    int bufPos = 0;
+
+    u8 buf[24]; // 8 codes * 3 bytes maximum
+
+    long validBitCount = 0; // number of valid bits left in "code" byte
+    u8 currCodeByte = 0; // a bitfield, set bits meaning copy, unset meaning RLE
+
+    while (srcPos < srcSize) {
+        long numBytes;
+        long matchPos;
+
+        numBytes = nintendoEnc(src, srcSize, srcPos, &matchPos);
+        if (numBytes < 3) {
+            // straight copy
+            buf[bufPos] = src[srcPos];
+            bufPos++;
+            srcPos++;
+            //set flag for straight copy
+            currCodeByte |= (0x80 >> validBitCount);
+        } else {
+            //RLE part
+            long dist = srcPos - matchPos - 1;
+            u8 byte1, byte2, byte3;
+
+            if (numBytes >= 0x12) { // 3 byte encoding
+                byte1 = 0 | (dist >> 8);
+                byte2 = dist & 0xFF;
+                buf[bufPos++] = byte1;
+                buf[bufPos++] = byte2;
+                // maximum runlength for 3 byte encoding
+                if (numBytes > max_runlen)
+                    numBytes = max_runlen;
+                byte3 = numBytes - 0x12;
+                buf[bufPos++] = byte3;
+            } else { // 2 byte encoding
+                byte1 = ((numBytes - 2) << 4) | (dist >> 8);
+                byte2 = dist & 0xFF;
+                buf[bufPos++] = byte1;
+                buf[bufPos++] = byte2;
+            }
+            srcPos += numBytes;
+        }
+
+        validBitCount++;
+
+        // write eight codes
+        if (validBitCount == 8) {
+            dst[dstPos++] = currCodeByte;
+            for (int j = 0; j < bufPos; j++)
+                dst[dstPos++] = buf[j];
+
+            currCodeByte = 0;
+            validBitCount = 0;
+            bufPos = 0;
+        }
+    }
+
+    if (validBitCount > 0) {
+        dst[dstPos++] = currCodeByte;
+        for (int j = 0; j < bufPos; j++)
+            dst[dstPos++] = buf[j];
+
+        currCodeByte = 0;
+        validBitCount = 0;
+        bufPos = 0;
+    }
+
+    return dstPos;
+}
+
+static void
+decompress(u8 *src, u8 *dst, int uncompressedSize)
+{
+    int srcPlace = 0, dstPlace = 0; // current read/write positions
+
+    long validBitCount = 0; // number of valid bits left in "code" byte
+    u8 currCodeByte = 0;
+
+    while (dstPlace < uncompressedSize) {
+        // read new "code" byte if the current one is used up
+        if (validBitCount == 0) {
+            currCodeByte = src[srcPlace++];
+            validBitCount = 8;
+        }
+
+        if ((currCodeByte & 0x80) != 0) {
+            // straight copy
+            dst[dstPlace++] = src[srcPlace++];
+        } else {
+            // RLE part
+            u8 byte1 = src[srcPlace++];
+            u8 byte2 = src[srcPlace++];
+
+            long dist = ((byte1 & 0xF) << 8) | byte2;
+            long copySource = dstPlace - (dist + 1);
+
+            long numBytes = byte1 >> 4;
+            if (numBytes == 0) {
+                numBytes = src[srcPlace++] + 0x12;
+            } else {
+                numBytes += 2;
+            }
+
+            // copy run
+            for(int i = 0; i < numBytes; ++i) {
+                dst[dstPlace++] = dst[copySource++];
+            }
+        }
+
+        // use next bit from "code" byte
+        currCodeByte <<= 1;
+        validBitCount--;
+    }
+}
+
+int
+process(const char *fpi, const char *fpo)
+{
+    u8 *bufi = NULL;
+    u8 *bufo = NULL;
+    FILE *fi = NULL;
+    FILE *fo = NULL;
+    long isize;
+    long csize;
+    long outsize;
+    long i;
+
+    fi = fopen(fpi, "rb");
+    error_when(fi == NULL, "Error opening file for reading: %s", fpi);
+
+    error_when(fseek(fi, 0, SEEK_END) != 0, "Error seeking in file: %s", fpi);
+    isize = ftell(fi);
+    error_when(isize < 0, "Error telling in file: %s", fpi);
+    error_when(fseek(fi, 0, SEEK_SET) != 0, "Error seeking in file: %s", fpi);
+
+    if (isize > 0) {
+        bufi = malloc(isize);
+        error_when(bufi == NULL, "Error allocating %li bytes", isize);
+        error_when(fread(bufi, 1, isize, fi) != (size_t)isize,
+                   "Error reading %li bytes from file: %s", isize, fpi);
+    }
+
+    error_when(fclose(fi) != 0, "Error closing file: %s", fpi);
+
+    if (isize < 5) {
+        // FIXME: encodeYaz0 segfaults in this case.
+        lament("Error: input file must be at least 5 bytes.\n");
+        goto error;
+    }
+
+    if (isize > 0x10
+        && bufi[0] == 'Y'
+        && bufi[1] == 'a'
+        && bufi[2] == 'z'
+        && bufi[3] == '0') {
+        outsize = (bufi[4] << 24)
+                | (bufi[5] << 16)
+                | (bufi[6] << 8)
+                |  bufi[7];
+        bufo = malloc(outsize);
+        error_when(bufo == NULL, "Error allocating %li bytes", outsize);
+        decompress(bufi + 16, bufo, outsize);
+
+    } else {
+        // we don't know how big the "compressed" file could get,
+        // so over-allocate!
+        // modern systems have more RAM than the largest Yaz0 file, so...
+        csize = 0x10 + isize * 2;
+        bufo = malloc(csize);
+        error_when(bufo == NULL, "Error allocating %li bytes", csize);
+
+        // write 4 bytes yaz0 header
+        bufo[0] = 'Y';
+        bufo[1] = 'a';
+        bufo[2] = 'z';
+        bufo[3] = '0';
+
+        // write 4 bytes uncompressed size
+        bufo[4] = (isize >> 24) & 0xFF;
+        bufo[5] = (isize >> 16) & 0xFF;
+        bufo[6] = (isize >> 8) & 0xFF;
+        bufo[7] = (isize >> 0) & 0xFF;
+
+        // write 8 bytes unused dummy
+        bufo[8] = 0;
+        bufo[9] = 0;
+        bufo[10] = 0;
+        bufo[11] = 0;
+        bufo[12] = 0;
+        bufo[13] = 0;
+        bufo[14] = 0;
+        bufo[15] = 0;
+
+        csize = encodeYaz0(bufi, bufo + 16, isize) + 16;
+
+        // pad compressed file to be a multiple of 16 bytes.
+        outsize = (csize + 15) & ~0xF;
+        for (i = csize; i < outsize; i++) bufo[i] = 0;
+    }
+
+    fo = fopen(fpo, "wb");
+    error_when(fo == NULL, "Error opening file for writing: %s", fpo);
+    error_when(fwrite(bufo, 1, outsize, fo) != (size_t)outsize,
+               "Error writing %li bytes to file: %s", outsize, fpo);
+    error_when(fclose(fo) != 0, "Error closing file: %s", fpo);
+
+    free(bufi);
+    free(bufo);
+    return 0;
+
+error:
+    if (bufi != NULL) free(bufi);
+    if (bufo != NULL) free(bufo);
+    if (fi != NULL) fclose(fi);
+    if (fo != NULL) fclose(fo);
+    return 1;
+}
+
+int
+main(int argc, char *argv[])
+{
+    if (argc <= 0 || argv == NULL || argv[0] == NULL) {
+        lament("You've met with a terrible fate.\n");
+        return 1;
+    }
+
+    if (argc != 3) {
+        lament("usage: %s {input file} {output file}\n", argv[0]);
+        return 1;
+    }
+
+    return process(argv[1], argv[2]);
+}