# Reverse-engineering an original scoring practice program

This is original educational Forge code, not a real game's binary, source or assets.
The MIT notice covers these practice files only. Other people's exercises are linked in the guide, not bundled.

Requires Linux x86_64, Python 3, a C compiler and GNU binutils (objdump, strip, readelf, nm and strings). Other systems need their matching compiler, file format and instructions.

Run the complete native reproduction:

    python3 check.py

It compiles only the included score_lab.c in a temporary directory at O0/O2,
inspects real ELF/symbol/string/disassembly output, strips copies, checks 111
inputs across four actual binaries against recovered.py and checks 24 invalid
invocations. No third-party game is downloaded or executed. Temporary binaries
are removed. Ghidra interactive/decompiler acceptance is separate and open.

For a manual investigation, create an empty practice folder, keep these files,
and run each command separately:

    cc -std=c11 -Wall -Wextra -g -O0 score_lab.c -o score_lab
    readelf -h score_lab
    ./score_lab 2 0 0
    ./score_lab 2 3 0
    ./score_lab 2 3 4
    strings score_lab
    nm score_lab
    objdump -d -M intel --disassemble=award_points score_lab
    cp score_lab score_stripped
    strip --strip-all score_stripped
    nm score_stripped
    objdump -d -M intel score_stripped

The three runs give 14,64,56. Tokens are worth7, chain>=3 grants50,
misses subtract2, tokens cap99 and the score floors0. That is our hypothesis,
checked against more inputs rather than inferred from three results alone.
Start without reading score_lab.c if you want a practice challenge; open it
after recording your predictions. This is a controlled exercise, not a claim
that the source was unknown to Forge's author.

For Ghidra use a non-shared project, import only your built practice binary,
confirm ELF/x86_64 and analyze. With symbols, open award_points and compare
Listing/Decompiler; on the stripped copy use the output string's references
and caller flow, mark hypotheses and rename only after evidence. Addresses,
instructions and pseudo-C vary with compiler/options. Pseudo-C does not recover
original comments, names, design intent or an entire game. A string alone does
not identify a scoring function. Cross-check arguments, branches and outputs.

Full public guide: https://binxforge.com/guides/reverse-engineer-game-mechanics