Binary Analysis¶

Static analysis findings for crimsonland.exe and grim.dll to aid decompilation.

Build Information¶

Original build path: ..\grim_grSystem_c\Release\grim.dll

Toolchain provenance¶

The former VC++ 7.1 attribution on this page was an early heuristic and is superseded by object-level evidence:

• the executable's optional-header linker version is 6.0;
• its Rich header contains product-10/product-11 build-9782 records consistent with the VC6 SP6 code generator;
• product-28/product-29 build-9178 records identify VC7-generation objects produced by the Windows XP DDK's 13.00.9176/9178 compiler, while product 25 build 9210 is Implib700 metadata rather than the final linker;
• the exact pinned DirectX 8.1 d3dx8.lib carries those build-9178 compiler records and matches the native D3DX ranges, establishing library-provider ancestry without implying a partial game-source migration;
• controlled Processor Pack objects use product 48/49 build 9044, which is absent from the executable; and
• the build-8047 records in grim.dll can be reproduced from members of the VC6 SP6 msvcrt.lib archive, so they do not identify an 8047 engine-code frontend.

An authentic VS6 RTM compile reports build 8168, ruling out RTM as a hidden 8047 compiler. Corpus-wide comparison also produces identical output from the available 8966 and 9782 optimizers across all current Crimsonland and Grim scratches. The exact XP-DDK build-9178 compiler closes four historical D3DX source controls, but produces no exact or improved result across the current 61 game-owned WIPs. Matching therefore uses msvc6.5 /O2 /GB as the compact canonical profile; alternate compiler profiles are search controls, not provenance claims.

See tools/match/README.md in the repository for the compiler inventory, hashes, Rich-header controls, and current corpus comparison.

Security Features (None)¶

• No debug symbols (PDB stripped)
• No RTTI (C++ class names not embedded)
• No SafeSEH
• No ASLR
• No DEP/NX
• No stack canaries

Sections¶

crimsonland.exe¶

Note: 378KB of .data is uninitialized (BSS) - global game state arrays.

grim.dll¶

Exports¶

grim.dll¶

Single export:

GRIM__GetInterface @ 0x100099c0

This returns a pointer to the Grim2D interface vtable.

Key Imports¶

crimsonland.exe¶

grim.dll¶

Embedded Resources¶

grim.dll¶

crimsonland.exe¶

VTables¶

grim.dll¶

crimsonland.exe¶

Embedded Libraries¶

grim.dll¶

Statically linked image libraries:

• libjpeg (IJG) - JPEG decoding
• libpng - PNG decoding
• zlib - Deflate compression

Evidence: Library signature strings found at:

• libjpeg: 0x04d0e9 ("JFIF")
• libpng: 0x04e29d
• zlib: 0x04e24c, deflate/inflate at 0x050971/0x0514a1

Identified Strings¶

C++ Class Names¶

Only one C++ method name found (no RTTI):

MyApp::Init  (grim.dll @ 0x05384e)

Grim2D Internal Names¶

GRIM__GetInterface  @ 0x05254b
GRIM_Font2          @ 0x053c3c

Registry Keys¶

Software\10tons\Crimsonland\        @ 0x073a6c
Software\10tons entertainment\Crimsonland  @ 0x074604

Network¶

http://buy.crimsonland.com  @ 0x071b40
www.crimsonland.com         @ 0x075584

Function Estimation¶

By prologue patterns¶

Note: Lower than Ghidra's count because many functions use different calling conventions or are inlined.

Useful Addresses for Decompilation¶

crimsonland.exe¶

grim.dll¶

Notes for Ghidra¶

1. No RTTI - Class names must be inferred from usage patterns
2. VS2003 compiler - Use Microsoft demangler for any mangled names
3. Fixed base for exe - No relocations, addresses are final
4. DLL has relocations - 5738 entries, useful for identifying code vs data references
5. Large BSS in exe - 378KB uninitialized, contains runtime game state arrays