codeblog code is freedom — patching my itch

February 13, 2009

World Of Goo compiled on Ubuntu

Filed under: Blogging,Debian,Reverse Engineering,Ubuntu — kees @ 3:44 pm

I first played World of Goo on the Wii. I loved it. Great stuff, reminded me a little of Lemmings, but way way better. Today I found out it’s also available for Linux, and I immediately downloaded it. I was pleased to see a .deb available and thought I’d dig into the binary a little to see how it was put together.

I’m hugely excited to see that it looks like the game was built on Ubuntu Intrepid for both the .deb and .tar.gz packages:

$ strings -a WorldOfGoo.bin | grep -i gcc
GCC: (Ubuntu 4.3.2-1ubuntu12) 4.3.2

The bundled libraries appear to come from Gentoo:

$ strings -a libs/ | grep -i gcc
GCC: (GNU) 4.2.3 (Gentoo 4.2.3 p1.0)

OpenSSL (and libpng?) from Gentoo seem to have been statically linked into the binary:

$ strings -a WorldOfGoo
GCC: (GNU) 4.2.3 (Gentoo 4.2.3 p1.0)

What I’m so very excited about is that third party software producers are using Ubuntu for their releases. This means they get all the security and code-quality improvements that are built into the Ubuntu compiler for free:

$ objdump -CR WorldOfGoo.bin | grep _chk
084043f0 R_386_JUMP_SLOT __memcpy_chk

Many thanks to Maks Verver for doing the porting. I’m really enjoying the demo. Also, I can see your devel path! :)

$ strings -a WorldOfGoo.bin | grep openssl
OPENSSLDIR: "/home/maks/Projects/wog/libs/openssl-0.9.8j-linux-i386/ssl"

All this said, it may be that they’re actually only compiling pieces (like the Open Dynamics Engine, which seems to contain the bulk of the *_chk calls) on Ubuntu (or using .a files from a distro-compiled library that enables hardening only in builds — RedHat, SuSE), but doing the .deb and .tar.gz project linking on Ubuntu (which is why the compiler name shows up in the resulting binary). The RPM shows the *_chk functions too — actually the disassembly is identical between deb and RPM, which would imply that only final linking was done on the native distros but compiled elsewhere. I’d love to hear more details if Maks stumbles on this blog. :)

© 2009, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License.
CC BY-SA 4.0


  1. Heh. I think you’d like 2 or so years late to the party.

    Celetania was released today too (windows and linux support right away), and here it how the output from that looks like:

    vadi@ubuntu:~/Games/celetania$ strings -a celetania.bin | grep -i gcc
    GCC: (GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu1)
    GCC: (GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu1)

    The archive games installer same:

    vadi@ubuntu:~/Games/ArchiveGames$ strings -a archivegames | grep -i gcc
    GCC: (GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu1)
    GCC: (GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu1)

    Same for mystic mine:

    vadi@ubuntu:~/Games/mysticmine_1.0$ strings -a mysticmine | grep -i gcc
    GCC: (GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu1)
    GCC: (GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu1)

    … and so on. I just found Vendetta to be compiled on Gentoo and Savage 2 didn’t show.

    Comment by Vadim P. — February 13, 2009 @ 5:29 pm

  2. Nice. I wish there was a screenie :)

    Comment by dannybuntu — February 13, 2009 @ 7:34 pm

  3. It’d be better if they were using Debian’s gcc ;)

    Comment by Debianero Rumbero — February 14, 2009 @ 11:54 am

  4. I have to disagree. In my opinion, Ubuntu’s compiler is better than any other distro’s compiler (discounting perhaps Hardened Gentoo, but that’s not strictly a “stock” distribution). Debian could turn on all the protections that are enabled in Ubuntu (it’s literally the same code base) with one easy change, but it would require convincing doko. :)

    Comment by kees — February 14, 2009 @ 12:18 pm

  5. Isn’t doko an Ubuntu person? Is he trying to sabotage Debian by not turning on hardening flags? Ubuntu sabotaging Debian is old news though I guess.

    Comment by Paul Duncan — February 14, 2009 @ 5:32 pm

  6. doko, like me, works on both Ubuntu and Debian. Debian prefers not to have the hardening options in the compiler, so I created the wrapper script to solve it there. (See

    There’s really no need to spread FUD about the Ubuntu/Debian relationship.

    Comment by kees — February 14, 2009 @ 5:49 pm

Powered by WordPress