Okayu Nyumu! and its shenanigans

[Inui-senpai]

I half-heartedly managed to download the trial version of the aforementioned game from the DMM GAMES website and, surprisingly, Entergram used the .datu8/.binu8 formats this time (instead of the .dat/.bin in the AQUARIUM. for PC).

I then re-downloaded your tools to make sure I'm using the latest version of it, and when I tried to decompile unpacked files, I've encountered the following problem: datu8_dump.py "hangs" on this files: stand, standpos, system and userconfig. But all of my .datu8's was decompiled and recompiled successfully via main.py in the tools subfolder, so it's not a big deal, I guess?

[kdw-code]

because datu8_dump isnt the right tool for this (i rewrote a better tool that transform every fields not just the strings).

use https://github.com/koukdw/Aquarium_tools/blob/main/tools/main.py

to export:
python main.py --to-csv --preset datu8 <file or folder_path>

to import
python main.py --to-binary --preset datu8 <file or folder_path>

for system.datu8 it's more like a config file but i haven't implemented a .ini file writer so instead you can use Edit CSV in vscode and then use Tools -> Transpose
or just use another csv editor that contains the same type of functionnality

That said you prob shouldn't modify anything in that file (it's basically the default preset list for the game)

also made a disassembler/assembler that work with okayunyumu (not releasing this in the repo yet as i want to rewrite it and consolidate all my other tools into this)
Install the requirements then the command are

To disassemble
python nexas_tools.py disassemble <script_path> <config_file>
To assemble
python nexas_tools.py assemble <script_path> <config_file>
nexas_tools.zip

Make sure to look at my research folder as some things might be confusing (like jump instruction)
Because jump instruction are setup weird (they increment the program counter) the code jump to 1 instruction before the actual target. Because i want my labels to be at the jump location, i commented some jump instruction as "Filler" those jump literally jump inplace then increment the program counter, they are still needed for the program to work.

For functions documentation download https://steamdb.info/app/2185800/ and look at it in dnspy it has all the functions reimplemented in clean c# code.
Most of the functions take an id as the first argument which is the index in the .dat file

[Inui-senpai]

Found an another issue: if I write any English text in the Name or Surname fields on the Player Name screen, it would be trimmed up to 8 symbols. But if I write any Russian text in any of the aforementioned fields, it would be trimmed up to 4 symbols (I can write up to 8 cyrillic symbols, though).

In the parsed playername.datu8 file I saw two 8's after the Name and Surname placeholders. As far as I understand, this 8's are "responsible" for the character limit. 🤔

[kdw-code]

@Inui-senpai I haven't reversed playername so i don't know what the fields means
With that being said, i think the input box is limited to 12 bytes which is enough for 4 utf8 characters in japanese and cyrillic
because each of those characters takes 3 bytes.
In english however the utf8 characters only takes 1 byte so it's only limited by the 8 characters limit.
it's plenty enough for japanese because most names don't go higher than 4 characters but i guess it's troublesome for cyrillic.

Edit: i found the function: sub_616550 (this is for the demo)
So basically the last parameter of that function is the character limit (8 just like in playername.datu8)
everytime we have a character we increase the counter by 1
this is for ascii but for character other than ascii we increase the counter by 2
once the counter is equal to the limit it clip all the characters left, that's why you end up limited to 4 characters.

So either you modify playername or you patch the game in that function so that cyrillic characters increase the counter by 1

[bfloat16]

because datu8_dump isnt the right tool for this (i rewrote a better tool that transform every fields not just the strings).

use https://github.com/koukdw/Aquarium_tools/blob/main/tools/main.py

to export: python main.py --to-csv --preset datu8 <file or folder_path>

to import python main.py --to-binary --preset datu8 <file or folder_path>

for system.datu8 it's more like a config file but i haven't implemented a .ini file writer so instead you can use Edit CSV in vscode and then use Tools -> Transpose or just use another csv editor that contains the same type of functionnality

That said you prob shouldn't modify anything in that file (it's basically the default preset list for the game)

also made a disassembler/assembler that work with okayunyumu (not releasing this in the repo yet as i want to rewrite it and consolidate all my other tools into this) Install the requirements then the command are

To disassemble python nexas_tools.py disassemble <script_path> <config_file> To assemble python nexas_tools.py assemble <script_path> <config_file> nexas_tools.zip

Make sure to look at my research folder as some things might be confusing (like jump instruction) Because jump instruction are setup weird (they increment the program counter) the code jump to 1 instruction before the actual target. Because i want my labels to be at the jump location, i commented some jump instruction as "Filler" those jump literally jump inplace then increment the program counter, they are still needed for the program to work.

For functions documentation download https://steamdb.info/app/2185800/ and look at it in dnspy it has all the functions reimplemented in clean c# code. Most of the functions take an id as the first argument which is the index in the .dat file

Thank you very much for your reverse engineering work!
But I encountered unknown opcode (41) when decompiling Full Kiss S. In which part of the exe should I find the assembly code for handling VM?
Or can I just ignore this opcode for now?

[kdw-code]

@bfloat16 depends on the platform i have different techniques.

On PC you can look for CScript RTTI information in IDA there will be 2 functions in that vtable. First one is the Opcode Handler and Second one is the function that handle the native functions for the script

On Switch it really depends on your ida version because the support isn't great but if it works you can do the same as the PC version.
If it doesn't work:
Opcode handler:
You can try looking for the string "POP" and search the function that use it, then you'll be in the POP handler, then you xref from the pop handler you'll be in the opcode handler.
Native functions handler:
look for __global.bin or __global.binu8 you'll be inside the functions that load the global bin file then xref that functions a few times until you end up in a function with a Huge switch statements, this is the native functions handler, on switch you wont even be able to decompile it because ida don't handle switch statement that are implemented as binary search, which usually happen when the case statement have huge gaps.
Alternatively you can maybe write an ida script and look for the biggest function in the executable. It's either the biggest or the second biggest

I don't think i'm missing opcode. Rather i think that the opcode are ordered differently. I had to deal with this with baldr sky

[kdw-code]

It's weird i looked at the demo of full kiss s there is no opcode with id 41

[kdw-code]

I think you can ignore it since that instruction probably is ignored by the game. There is no switch case for the id 41
in Disassembler init

add "UNK_41": self.handler_simple,

and use that config

fullkiss_s_pc.zip

[kdw-code]

If you want function name you'll have to look at aonatsu line config and look into the native functions handler in IDA to ensure each function is correct. This take me like 4 hours to do so sorry if you want that but it's a bit too much work.

[kdw-code]

You also have to add the opcode into assembler script if you want to assemble of course

[bfloat16]

I think you can ignore it since that instruction probably is ignored by the game. There is no switch case for the id 41 in Disassembler init

add "UNK_41": self.handler_simple,

and use that config

fullkiss_s_pc.zip

Thank you very much, now the decompilation script is completely fine!

[kdw-code]

aozora_re_pc.zip
hukusuba_pc.zip

Quickly made config (i tested quickly seems to work) for:

Tasogare ni Hisomu Fukurou to, Akegata no Subaru
https://vndb.org/r130805
Kono Aozora ni Yakusoku o
https://vndb.org/r126596

[rikimtasu]

aozora_re_pc.zip hukusuba_pc.zip

Quickly made config (i tested quickly seems to work) for:

Tasogare ni Hisomu Fukurou to, Akegata no Subaru https://vndb.org/r130805 Kono Aozora ni Yakusoku o https://vndb.org/r126596

thanks,can confirm new decompilation config for Kono Aozora ni Yakusoku o Refine PC ver worked for exporting to yaml.
Do i need to write my own config for exporting yaml to the name/message json used in SExtractor?