Reversing Noita quickstart - noita-player/noitadocs GitHub Wiki

Noita is currently a 32-bit ~20MB single PE file. SDL2 and Lua5.1 are dynamically linked. Investigation for what all is statically linked into the binary for creating FLIRT signatures is ongoing, currently we know:

Statically Linked library	IDA FLIRT db
libcpmt (MSVC 12.0 C++ STL)	❌
libcmt (MSVC 12.0 C STL)	❌
libvcruntime	❌
a few misc vcruntime methods	✔️ vc32rtf.sig, vc6win.sig

For the missing vc12 libraries, a decent temporary workaround is to load these from here:

FLIRT signature: C++ Standard Library x86 (MSVC 15, /MT)
FLIRT signature: Visual C Runtime x86 (MSVC 15)
FLIRT signature: MSVC C Standard Library for x86 (/MT)

RTTI

Noita has extensive RTTI information! Grab classinformer for IDA from their releases page, extract it to your plugins folder, and load noira. You'll be able to run it from edit->plugins->classinformer. Here's a pretty diagram that shows all class inheritance, ctrl+f to zoom around it. Works best in Chrome.

Interesting classes

• WizardPakFileDevice - Guess what wak in data.wak stands for? Wizard pAK!

Asset layout

Scripts / data.wak

Much of the game is comprised of lua5.1 scripts contained within data.wak. Use wakman.py in this repo to extract this archive. The structure of their lua project is like so:

put "tree extracted" here

Images

???

Audio

???