[Game Mod Code Deep Dive] Modding RollerCoaster Tycoon into a Peele Horror Film

This is Part 2/2 of the tutorial: Part 1 covers the reversing of RCT's graphics/sound systems and the building of the horror mod, while Part 2 deep dives into the Python and shellcode used to automate this mod (linked in the repo below).

This tutorial showcases how to write a RollerCoaster Tycoon mod in Python that implements the following "horrific" changes to the gameplay:

Any roller coaster crash/explosion will trigger the following:
1. A spinning skull animation at the crash site (animation can be changed)
2. A horror soundtrack which plays in the background (track can be changed)
3. Guests in the park will turn towards the player and applaud
Plus, the game window title will be renamed to "RollerCoaster Diecoon"...because "horror"...

After months of research, reversing, and coding, I am beyond happy to finally share this one with you all - Thanks, truly, for the patience and support as without it, this video may have never been finished.

But now I'm so happy to have stuck with it, and I hope you enjoy this journey of bringing a stupid, silly fever dream to light, while learning a ton about game hacking/modding and reversing.


Please leave feedback and questions here as comments, or DM me on Mastodon (social links listed on the channel).

Check the pinned comment for any updates to the content.

Let me know what you would like to see in future videos!


Project Homepage:

https://github.com/jeFF0Falltrades/Tu...


Resources and References:

Tooling:
Ghidra: https://ghidra-sre.org/
IDA: https://hex-rays.com/ida-free/
x64dbg: https://x64dbg.com/
Online Assembler/Disassembler: https://defuse.ca/online-x86-assemble...
Python dataclass Docs: https://docs.python.org/3/library/dat...

RCT Technical Information Depot and More:
https://tid.rctspace.com/
https://rv.rctspace.com/?rv=hwinkels2
https://strategywiki.org/wiki/RollerC...

Windows Library/Graphics Resources:
https://www.tech-insider.org/windows/...
https://github.com/Subhankar2000/DOS_...
https://learn.microsoft.com/en-us/win...
https://learn.microsoft.com/en-us/win...
https://learn.microsoft.com/en-us/win...
https://learn.microsoft.com/en-us/win...
https://learn.microsoft.com/en-us/win...
https://en.wikipedia.org/wiki/BMP_fil...
https://en.wikipedia.org/wiki/Microso...
https://learn.microsoft.com/en-us/pre...)
https://www-user.tu-chemnitz.de/~heha...
https://www-user.tu-chemnitz.de/~heha...
https://www.compuphase.com/palette.htm

Chapters in Part 2:

00:00:00 - Intro
00:02:20 - Main/Runner Script
00:11:02 - BITMAPINFOHEADER Struct
00:16:17 - RGBQUAD Struct
00:18:17 - TGraphicRecord Struct
00:22:09 - BITMAP Struct
00:25:19 - Direct Bitmap Entries
00:30:15 - Palette Bitmap Entries
00:42:00 - Compact Bitmap Entries
01:08:23 - Windows Process Struct
01:13:09 - Bitmap Extract Utility
01:22:23 - DIB/Palette Dump Utility
01:28:18 - Process Dumper Utility
01:39:12 - Horror Patcher Utility
02:04:38 - Epilogue: Revisiting the Bug from First RCT Tutorial
02:24:35 - Wrap-Up