Reversola – Reverse Engineering Sola Rola

Banner

Introduction

I was browsing the Kongregate forums one day, when a post caught my eye. It was a list of broken games on the site that still had achievements to earn, and the clever ways that people had found to progress in those games far enough to earn the achievements. Sola Rola: The Gravity Maze was one of the few that hadn’t been solved. This game was interesting because not only was it broken on Kongregate, it was also broken on every single other Flash game portal out there, including the game’s own sponsor Gimme5Games and the website of its creator, EvilFree Productions.

This was a simple physics-based game where you rotate the environment, similar to Loco Roco, but with its own cheeky characters having to navigate a maze. Around September 24, 2010, something changed that broke the game. No matter which website or computer you accessed it from, the game would show the sponsor logo and then a blank white screen. For two years, seemingly no one could figure it out, so in September of 2012, I set out to investigate it myself. Two weeks later, with the help of the Kongregate community, we were able to recreate the original levels to get a working version of the game for people to play and — if they are into this sort of thing — earn the achievements.

Why it Doesn’t Work

A few people already found out why the game doesn’t load. When the game starts, it tries to load two XML files: translate.xml, containing language strings, and levelList.xml, containing the level list. The problem is these files were ONLY located on the Gimme5Games server and the files are now nowhere to be found. This explains why the game was broken no matter which portal hosted the game (SWF file). After an hour of fruitless searching through internet archives, and several efforts to contact the developer, it was clear the original files would not be found. Another approach had to be taken.

In April of 2012, askon, a Kongregate user, posted the source code decompiled from the game’s SWF file, and a way to fool the game into starting with an empty XML file. All that was missing were the contents of that file — the level data! Fortunately, someone had recorded every single level of the game on Youtube, so we had hope to reconstruct the levels, if we only we knew the structure of the XML files. That is where I would come in. More on that later.

Getting the Game to Start

Network diagram

The hosts file entry bypasses the DNS lookup and redirects requests to our server.

When the game starts, it requests the XML files using ordinary HTTP requests to “http://www.gimme5games.com/solarola/translate.xml” and “http://www.gimme5games.com/solarola/levels/levelList.xml”. Since those are gone forever, we need the game to look for those files on a different server — one that we control. One obvious way would be to modify the compiled SWF file itself, however that wouldn’t allow us to earn achievements on the Kongregate site. Instead, we will redirect the request at the DNS lookup step. The easiest way to do this is to modify the “hosts” file of the local machine. Now, instead of asking a remote DNS server for the IP address of gimme5games.com, our PC will simply use the entry in our hosts file.

Reverse Engineering the Level XML

Despite not being a Flash developer of any kind, I took up the challenge of reconstructing the XML files from the decompiled ActionScript source code alone — all 14,700 lines of it. Fortunately, ActionScript is very similar to JavaScript (both are variants of ECMAScript), which I am familiar with.

Let me be clear. There is no level data anywhere in the source code. All the information about levels is contained in the XML, which we didn’t have. However, the source code is expecting a certain structure from the XML file. And that’s what we will reconstruct.

The first step was to search for “levelList.xml” and see where it was used. It is parsed and saved in an XML object, SolaRola.levelListXML. This variable is used in a couple of places:

public function loadLevelNumber(_arg1:Number){
var _local2:String;
// ...
_local2 = levelListXML.item[_arg1].@label;
if (levelListXML.item[currentLevelNum].@grav == "true"){
_local2 = true;
};

From these two statements we can infer something about the levelList.xml file. Under the root, it has multiple <item> elements — one for each level. Each <item> element has two attributes: “label” and “grav.” A bit more digging shows that label is the filename for each level’s XML file, and grav controls whether there is a “gravity beam” (or rope) in that level. The resulting levelList.xml file looks something like this:

<levels>
<item label="level-1.xml" grav="false" />
<item label="level-2.xml" grav="false" />
<item label="level-3.xml" grav="false" />
...
</levels> 

The individual XML file for each level itself is larger and more complex, but was reverse engineered in much the same way.

Writing the level editor

Long story short, the game is looking for a list of levels in levelList.xml that points to another XML file per level. With 48 levels, that brings us to 50 XML files total that are needed. It took me about 30 minutes to recreate the XML file for the first level, but I made a lot of mistakes. I had to count the x and y coordinates of each tile, wall, and item, and then insert those properties into the XML file. This was really error-prone and took several tries to get it right. Manually recreating all 48 level XML files looked like a daunting task. But I’m a programmer, and programmers hate doing repetitive tasks manually. So I wrote a level editor using HTML, CSS, and JavaScript.

Screenshot

A screenshot of the Sola Rola Level Editor

Writing the level editor took about 6 hours, but it was well worth it. I enlisted the help of volunteers from the Kongregate forums to help create levels with it, lowering my workload. With a visual representation of the level you are editing, it’s much faster to create levels, as well as verify and correct the mistakes in them, of which there were many. We ended up with errors in 19 of the 48 initially created levels, which I then  corrected using the editor.

The Sola Rola level editor is still available, and it also opens up the door to user-created custom levels later.

Dialogue – The Missing Piece

With all the levels completed, there was still one part we couldn’t fully restore – the dialogue text. The game is available in 6 languages (English, Spanish, German, Italian, French, and Polish), and so once again, all the text is located in an XML file, translate.xml. I managed to recreate this file, but only the menus, and the parts of the dialgoue that could be visible from the Youtube videos. I estimate only about 40% of the in-game dialogue is there, and 0% of the opening animation. This is only the English translation; other languages are still missing. If you are interested, that translate.xml file is available here, in case you want to help.

Conclusion and Lessons Learned

On September 29, 2012, I posted instructions to fix Sola Rola using a hosts file modification. Any user can modify the hosts file on their personal PC and get the game running. This will fix the game on all sites, including Kongregate, Newgrounds, etc., though it will block the Gimme5Games website (this is easily reversible).  All 48 original levels are restored, and parts of the dialogue are there, but only in English. Since we never modified the SWF code itself, the Kongregate API for earning achievements is also working perfectly, as I expect it will on other sites.

Key takeaways for developers: While using XML to define levels and translations is smart, it’s not so smart to have only one copy of those files hosted on one server. Essentially this was a single point of failure that broke the game for all sites. Redundancy is important. Another lesson learned is that investing in automation early pays off greatly, as was the case with my level editor.

For me, this project was an interesting diversion from my day job coding network C code. I’m not sure why, but compared to tracing other people’s C code, tracing the ActionScript was a lot easier, perhaps because of the object-oriented (OOP) nature of AS3. Last but not least, I must thank the Kongregate community who helped restore the game in just under 2 weeks!

zAlbee

  1. please make a video of of getting sola rola working the hosts file way, the way you add the following gimme5games.com line and saving it then testing it, I tried it several times but never ever works!!

    • Most likely it failed to save because of permissions. Under Windows, you need to right-click Notepad and “Run as Administrator”, then open the hosts file from there. If you need more help, there are tutorials on the internet for how to do this. Good luck!

  2. Just commenting on this blog post because you deserve far more credit for your magnificent and beneficent efforts. You’ve done the internet equivalent of restoring a lost work of art. Kudos

  3. Wouldn’t this also break other games that store levels in XML files on gimme5games?

    • You’re right, it would. Fortunately, I don’t think very many games host their files like this; I personally haven’t seen any other game do this on gimme5games.com.

Leave a Comment