Why do this?

I recently watched a presentation on PSP Homebrew Developer Conference by Precise Museum. In the presentation, they talked about their new translation patch for PSP game Puyo Puyo!! 20th anniversary, and a problem they came across while making this patch: If a non full-width character (ie. a character narrower than the font grid) appears in any row other than the first row in the font file, it will not display properly. They worked around this strange bug by shrinking the size of the font and re-arranging the characters.

This raised my interest, because 5 years ago, when I started tinkering around the Wii version of this game in order to make a Chinese translation patch, I came across this bug too. It was not so much of a problem for me, as Chinese characters are all full-width, and I can easily fit a few other characters in the first row. (The Chinese patch was later stalled, because I couldn’t find translators in Chinese Puyo fandom.)

I happened to have Ghidra and some spare time at hand, so I decided to dig into this bug, to find out its cause and potentially a fix. I don’t have much experience in reverse engineering, and I only have did anything to two Unity games (which are very easy to analyze, as they are not obfuscated and their symbols are there in plain sight). Let’s see if I can learn anything this time.

Background: Text formats used by the game

Before we begin, I need to introduce the file formats used by this game to display texts. There are already tools made to edit them: Puyo tools and Puyo text editor. By reading their source code, I can learn about the formats. Let me borrow a image from the presentation:

The image shows the FNT file, which the game uses to store its font. The file header defines the grid size and character count, and a table follows, describing each character’s UTF-16 encoding and width. After the list is a texture file (GIM on PSP, or GVR on Wii) storing the graphics for each character. Note that the placements of the characters are aligned in the grid defined by the file header, and are not affected by the width written in the table.

There is an MTX file for each FNT file. MTX files store the string data used by the game, and each character in the string are encoded by a 2-byte index in the FNT table. For example, い is encoded as 0000 in the font file shown in the image.

The real work

Background

One day I was scrolling through my Fediverse timeline and saw someone on the instance posted (I can’t find the original post now but it was something like):

Meshtastic is modern Pictochat

Pictochat is a feature available on the Nintendo DS, allowing players to chat with each other by exchanging images with nearby consoles. I don’t have a DS, but I have a 3DS, which has a somewhat similar feature called Streetpass, allowing it to communicate with nearby consoles while in sleep mode, which I think is very cool. The post raised my interest on Meshtastic, so I searched a bit and learnt that it is an open source off-grid mesh network based on LoRa devices. And then I just kinda forgot about it.

Later when watching some 38C3 talks, I came across Meshtastic again. There was 2 talks featuring Meshtastic (this and this), both of which mentioning that nodes are pretty cheap (as cheap as $5-$7 if DIY, I should be able to lower that by getting cheaper parts here in China), so I wanted to try it out.

It happened that lyc8503 was interested in building his own networks too, so we decided to try Meshtastic at school. He has already written a blog article about the whole procedure. You should probably read that before continue reading. I only add some of my own thoughts and experiments here.

Choice of Hardwares and Cost Concerns

After watching the talks, I did a quick search about off-the shelf devices (development boards) that Meshtastic supports, and found that they are all priced at over 100 CNY (~14 USD), which is well over my expectation. Now I have to build the nodes myself.

The cost of the first MCU + LoRa combination that we used, ESP32 + SX1278(Ra-01), is about 40CNY (~6 USD). This doesn’t include the antenna and the screen. Although we have a cheaper ESP32C3 as MCU, but we just couldn’t make it work somehow (we couldn’t make it boot and there was no serial output to diagnose, and we just gave up after some guessing). Later we tried the relatively cheaper nRF52840 + SX1268 (E22-400MM22S) combination, which costs around 20 CNY (~3 USD) including the antenna. However the SX1268 LoRa module was bought at the sample price of 6 yuan. If I need more than 2 nodes, I have to buy them at the normal price of 20 yuan, which brings the cost per node up to almost 40 CNY. Also I need to solder them manually.

Additionally, I bought the U-blox NEO-6M GPS modules, which costs 11 CNY per module. They can provide geolocation info for nodes, though not very precise.

I upgraded an old computer at my home and turned it into homelab 2 years ago. It ran perfectly since then, until recently…

The Beginning

One day I was doing something with the server through ssh as usual, and then suddenly the commandline stopped responding for about a minute. And then every command started failing with I/O Error:

Soon afterwards the ssh connection stopped responding too, and I had to go check out the server. I plugged in the monitor but there was no display output and the keyboard can’t respond to NumLock nor CapsLock, though the server is definitely still running. I had to hard reset the machine. After the reset the BIOS couldn’t detect the system drive anymore. Suspecting a bad connection, I moved the drive to another SATA port, and restarted the machine. This time the machine detects the drive and started normally. However, it didn’t last long and started to spam I/O Error again.

Now this is bad. The SSD must be failing. Unfortunately I didn’t back up the system drive at all because it didn’t hold much valuable data. But it can still be annoying to re-install the OS and re-configure all the services.

After another hard reset the BIOS can’t detect the drive again, and I have to keep the machine powered off for some time to have it detect the drive again. And then I tried to use a Live CD and dd the data out of it, but it stops after ~4GiB:

Hello! This is my blog. As you can see, it is a retro-themed blog site, though still using somewhat modern technology. Maybe I’ll make one with vanilla html later.

My posts are written in Chinese first and then some of them will be translated to English by myself. I seperate the 2 sites for now because I couldn’t figure out how to do i18n with Hexo properly.