I first played World of Goo on the Wii. I loved it. Great stuff, reminded me a little of Lemmings, but way way better. Today I found out it’s also available for Linux, and I immediately downloaded it. I was pleased to see a .deb available and thought I’d dig into the binary a little to see how it was put together.
I’m hugely excited to see that it looks like the game was built on Ubuntu Intrepid for both the .deb and .tar.gz packages:
$ strings -a WorldOfGoo.bin | grep -i gcc
...
GCC: (Ubuntu 4.3.2-1ubuntu12) 4.3.2
The bundled libraries appear to come from Gentoo:
$ strings -a libs/libogg.so.0 | grep -i gcc
...
GCC: (GNU) 4.2.3 (Gentoo 4.2.3 p1.0)
OpenSSL (and libpng?) from Gentoo seem to have been statically linked into the binary:
$ strings -a WorldOfGoo
...
GCC: (GNU) 4.2.3 (Gentoo 4.2.3 p1.0)
_x86_AES_encrypt
...
What I’m so very excited about is that third party software producers are using Ubuntu for their releases. This means they get all the security and code-quality improvements that are built into the Ubuntu compiler for free:
$ objdump -CR WorldOfGoo.bin | grep _chk
...
084043f0 R_386_JUMP_SLOT __memcpy_chk
Many thanks to Maks Verver for doing the porting. I’m really enjoying the demo. Also, I can see your devel path! :)
$ strings -a WorldOfGoo.bin | grep openssl
OPENSSLDIR: "/home/maks/Projects/wog/libs/openssl-0.9.8j-linux-i386/ssl"
...
All this said, it may be that they’re actually only compiling pieces (like the Open Dynamics Engine, which seems to contain the bulk of the *_chk calls) on Ubuntu (or using .a files from a distro-compiled library that enables hardening only in builds — RedHat, SuSE), but doing the .deb and .tar.gz project linking on Ubuntu (which is why the compiler name shows up in the resulting binary). The RPM shows the *_chk functions too — actually the disassembly is identical between deb and RPM, which would imply that only final linking was done on the native distros but compiled elsewhere. I’d love to hear more details if Maks stumbles on this blog. :)
© 2009, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License.
Heh. I think you’d like 2 or so years late to the party.
Celetania was released today too (windows and linux support right away), and here it how the output from that looks like:
vadi@ubuntu:~/Games/celetania$ strings -a celetania.bin | grep -i gcc
libgcc_s.so.1
GCC: (GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu1)
GCC: (GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu1)
[…]
The archive games installer same:
vadi@ubuntu:~/Games/ArchiveGames$ strings -a archivegames | grep -i gcc
libgcc_s.so.1
GCC_3.0
GCC: (GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu1)
GCC: (GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu1)
Same for mystic mine:
vadi@ubuntu:~/Games/mysticmine_1.0$ strings -a mysticmine | grep -i gcc
GCC: (GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu1)
GCC: (GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu1)
… and so on. I just found Vendetta to be compiled on Gentoo and Savage 2 didn’t show.
Comment by Vadim P. — February 13, 2009 @ 5:29 pm
Nice. I wish there was a screenie :)
Comment by dannybuntu — February 13, 2009 @ 7:34 pm
It’d be better if they were using Debian’s gcc ;)
Comment by Debianero Rumbero — February 14, 2009 @ 11:54 am
I have to disagree. In my opinion, Ubuntu’s compiler is better than any other distro’s compiler (discounting perhaps Hardened Gentoo, but that’s not strictly a “stock” distribution). Debian could turn on all the protections that are enabled in Ubuntu (it’s literally the same code base) with one easy change, but it would require convincing doko. :)
Comment by kees — February 14, 2009 @ 12:18 pm
Isn’t doko an Ubuntu person? Is he trying to sabotage Debian by not turning on hardening flags? Ubuntu sabotaging Debian is old news though I guess.
Comment by Paul Duncan — February 14, 2009 @ 5:32 pm
doko, like me, works on both Ubuntu and Debian. Debian prefers not to have the hardening options in the compiler, so I created the wrapper script to solve it there. (See http://wiki.debian.org/Hardening)
There’s really no need to spread FUD about the Ubuntu/Debian relationship.
Comment by kees — February 14, 2009 @ 5:49 pm