I've had a lot of success decompiling old video game ROMs in exactly this way. Like you say - give it a way of verifying correctness - put it in a loop - and they are quite surprising.

https://github.com/qarl/arcade-js

▲

kenerwin88 2 hours ago | parent | next [-]

Oh wow, this is almost exactly what I’ve been doing with Zelda LTTP. I have it in rust now, but just finished the “first pass” you reference. Mine is still not really readable, second step is the modernizing the actual code. I’ve really struggled with needing to handhold it though, I’ll see if I can plagiarize from you!

	▲	qarl2 an hour ago \| parent [-]
		I'm working on getting the "handholding" down to zero. Frogger is almost done and I haven't had to intervene once.

▲

BlackRabbit1 4 hours ago | parent | prev | next [-]

Same. I love reverse engineering embedded stuff.

Even the cheap LLMs are great in doing the awful crud work in the beginning: finding offsets, firmware update file structures, brute forcing checksums, etc.

It still produces a lot of crap in the later steps (understanding the implementation itself) but I'm happy doing this stuff myself then.

	▲	qarl2 4 hours ago \| parent [-]
		> It still produces a lot of crap in the later steps (understanding the implementation itself) I've had success here by adding a phase called "grounding" that attempts to verify its "understanding" by creating tests that modify the running executable to ensure its made the right inference. Is this variable really MARIO_X? Change it and see if Mario moves. Etc. As an example in Donkey Kong - the system had trouble deciding if an array controlled barrels or fireballs. There was conflicting evidence. After many trips through the loop - it realized it does BOTH, depending on which level you're on. So the "understanding" grows with each iteration.

▲

revetkn an hour ago | parent | prev [-]

Very cool, me too! I've been working on Final Fantasy Legend (Game Boy and WonderSwan Color) and King's Bounty (PC - DOS). It's great for reversing. Really interesting to see the guts of the games, including bugs.

	▲	qarl2 36 minutes ago \| parent [-]
		The most interesting thing I've found so far is the anti-tampering mechanisms. In Time Pilot - there are three routines that are called constantly from inside the main loop. Each routine computes the checksum of the other routine's code to see if it's been modified. If so it jumps into random junk data. There are other less exotic routines that make sure the copyright string hasn't been modified, etc. https://github.com/qarl/arcade-js/blob/main/games/timeplt/id... Fascinating.