DEV Community: LulLaS

A formally-verified OCaml tool to recover RPG Maker assets — one binary, zero deps

LulLaS — Sun, 02 Aug 2026 14:23:46 +0000

RPG Maker games ship their assets encrypted. If you need to get them back
legitimately — recovering your own project, a lost encryption key, an
authorized translation, or game preservation — you usually end up juggling
several format-specific scripts. I wanted one tool that just works, and can't
misbehave on hostile input.

So I built rpgm-decrypt in OCaml.

## What it does

All five engine generations — XP / VX / VX Ace (.rgssad, .rgss2a, .rgss3a) and MV / MZ (.png_, .ogg_, .rpgmvp, .pak) — one command.
Finds the key for you — reads System.json / scans rpg_core.js automatically, no manual key hunting.
One self-contained binary — no Python, .NET, or Node. Copy it, run it.
JSON / NDJSON output — pipes straight into jq for scripting.

## The part I actually care about: it can't misbehave
This is a parser eating untrusted binary input, so correctness and safety were
the whole point:

Fuzzed 21M+ iterations, zero crashes. Corrupt/hostile input degrades gracefully instead of blowing up.
Zip-Slip blocked by construction — extracted paths can never escape your output folder.
Formally verified core — key functions carry Gospel contracts, and core safety properties are machine-checked with Why3 / Z3.
Mutation-tested — 7/7 mutants killed.


console
  $ rpgm-decrypt ./MyGame ./decrypted
  [key]  found encryptionKey in www/js/System.json
    >  Title.png_  ->  decrypted/www/img/Title.png  [MV]
  === summary ===  scanned: 1873  decrypted: 1869  failed: 0

  ▎ Use it on content you're allowed to touch — your own work, a lost key, an
  ▎ authorized translation, or preservation. That responsibility is yours.

  GitHub: https://github.com/rolanfreeman6-png/rpgm-decrypt

  Curious what other RPG Maker archive formats people still need supported.

I built a zero-dependency Go CLI to package RPG Maker games

LulLaS — Sun, 02 Aug 2026 14:14:33 +0000

Releasing an RPG Maker game means a lot of manual, error-prone steps: check the
project, strip debug/save files, build per-platform archives, and ship them to
itch.io or Steam. I built RPG Maker Release Forge to make it one command.

## What it does

Every engine — MV, MZ, XP, VX, VX Ace, and 2000/2003.
Audit before build — finds missing engine files, broken asset references, invalid JSON, and shipped save/debug/backup files.
Reproducible builds — identical inputs produce byte-identical zips.
Delta patches — ship only what changed between two releases, with SHA-256 verification on apply.
Store adapters — itch.io (butler) and Steam (steamcmd), dry-run first.

## Why it's interesting technically

Zero third-party Go modules — the whole CLI is standard library only.
Supply-chain safe — runtime fetch verifies the NW.js archive SHA-256 against the official SHASUMS256.txt before extracting.
Detection never runs project code — engine detection is file-marker based.


sh
  go build ./cmd/rm-release
  rm-release audit ./MyGame --target web
  rm-release build ./MyGame --platform web
  rm-release patch ./dist/v1.0 ./dist/v1.1

  GitHub: https://github.com/rolanfreeman6-png/RPG-Maker

How to hide strings in C++ binaries with consteval

LulLaS — Tue, 07 Jul 2026 02:06:48 +0000

How to hide strings in C++ binaries with consteval — and why it beats xorstr

The problem

Every C++ binary has strings. strings.exe reads them. Competitors see your API keys. Reverse engineers find your logic. Anti-cheat detects your function names.

The old way — xorstr (constexpr XOR)


cpp
auto key = xorstr_("my_api_key");

Problem: constexpr depends on the optimizer. MSVC doesn't fold it — plaintext leaks to .rodata. Also: dangling pointer in xorstr_() macro (returns char* from temporary).

StealthLib — consteval (compiler-independent)
auto key = S("my_api_key");
consteval forces compile-time evaluation on every compiler. Plaintext is consumed during translation — never emitted. Verified by binary_scan_test on MSVC + GCC + Clang.

Differential testing
Same strings, same compiler, same platform:

StealthLib: 7/7 PASS
xorstr:     3/7 FAIL (dangling pointer)
What else is inside
Hash-based API resolution (no API names in binary)
4-channel anti-debug (PEB + NtQuery + rdtsc + DR registers)
IAT/EAT integrity checks
VM detection (CPUID + DMI + disk)
FIPS-180-4 SHA-256
Per-build key rotation (16 variants)
RAII auto re-encrypt guards
Quality
6 SAST tools clean: PVS-Studio (0 findings), SonarCloud (A ratings), CodeQL, Coverity (0.17 density), Semgrep, Codacy.

4.5 billion fuzz executions, 0 crashes. 40 mutation tests, 100% killed. 94.6% coverage.

GitHub
https://github.com/rolanfreeman6-png/stealthlib