dwgx@blog:~$dwgx
> cd ../posts

ReC98: Bit-Perfect Reverse Engineering of the Five Touhou PC-98 Games

// created

ReC98 is the Touhou PC-98 restoration project that nmlgc has been chipping away at through crowdfunding, with the goal of fully restoring ZUN’s earliest five games, TH01 through TH05, into compilable source. These titles are from 1997 and 1998, only ever ran on the PC-9801, went out of print long ago, and even ZUN himself says the original data is lost. This is a fork of mine; I’m not changing anything, just following along to build and study it, because it’s the most hardcore reverse engineering I’ve come across.

Its bar is brutal: the binaries built from the repo have to be byte-for-byte identical to the originals, and every commit has to keep it that way. All you have is the binary, no variable names or comments, so the criterion is “you can’t prove the original code couldn’t have looked like this.”

It didn’t go the PyTouhou route of black-box rewriting; it holds to a full decompilation. The reasoning is down to earth: the mob danmaku in TH04 and TH05 is .STD bytecode, which you could parse with a separately written VM, but the midbosses and bosses are all hardcoded into the exe, so there’s no getting around it.

What actually makes this work feasible is recognizing the two libraries the five games share, master.lib (a PC-98 DOS abstraction layer written in 16-bit x86 assembly) and the Borland C/C++ 4.0 runtime, and that source for both was found. In TH05 alone these two account for 74% of OP.EXE and 40% of MAIN.EXE, cutting the workload down enormously. TH01 also used BERO’s Pi loader, and TH03’s ZUNSP.COM is actually a reskin of Promisence Soft’s SPRITE16.COM.

The only usable compiler is the same Borland Turbo C++ 4.0J that ZUN ran back then; nothing else can produce a byte-for-byte match. Borland never made a cross-compiler for building 16-bit DOS on 32-bit Windows, so the C++ can only be compiled inside a DOS emulator. The build chain uses MS-DOS Player to run the DOS tools, and Tup for incremental parallel builds; it tracks #include dependencies by hooking the compiler’s file-open system calls, far cleaner than make. On Win11, a single build.bat ships everything, with output landing in bin\th0?, but to actually run it you need the original assets yourself, since the repo contains no game data.

TH01’s decompilation was fully done back in August 2022, and per the author the remaining games are just a matter of time. The focus later shifted toward documenting and researching ZUN’s original code, and the project blog on rec98.nmlgc.net has ironically become the main course.