it has been zero days since MSC5's little "push cs;CALL (not CALLF) farfunction" trick has confused ghidra
Conversation
Notices
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 25-May-2025 13:19:04 JST Foone🏳️⚧️
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 25-May-2025 13:19:02 JST Foone🏳️⚧️
running this software at 15 cycles/second, I can confirm that the creators of it definitely didn't do that.
their general approach is "I KNOW PROGRAMMERS WHO TRY TO AVOID OVERDRAW AND THEY'RE ALL COWARDS
Haelwenn /элвэн/ :triskell: likes this. -
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Sunday, 25-May-2025 13:19:03 JST Foone🏳️⚧️
PUSH DS
PUSH peel_ptr
PUSH DS
PUSH peel_ptrthe pointer so great they pushed it twice!
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:57:57 JST Foone🏳️⚧️
what do you mean he changed his money to rupees?
You're in Sri Lanka! YOUR currency is rupees!Haelwenn /элвэн/ :triskell: repeated this. -
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:57:57 JST Foone🏳️⚧️
I'm experimenting with a way to show how DOS games render themselves.
Basically I'm recording a lossless video of the game running on a very slow CPU, then removing all the frames where nothing happens, and I'm playing it back sped up a lot.The highlight of this video is how terrible the handling of the mouse cursor is! it's getting peeled and restored constantly
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:57:58 JST Foone🏳️⚧️
another way in which this game shows that it's from 1990 is that the librarians will tell you anything about their patrons.
that shit stopped after 2001
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:57:59 JST Foone🏳️⚧️
the game picks between "they flew off to X" and "they drove off to X" and "they rowed off to X" and "they sailed off to X" but it doesn't seem to do this with any smarts.
or if it does, the database is incorrect.carmen apparently drove off to nepal from canada
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:57:59 JST Foone🏳️⚧️
The game also refers to the capitol of china as Peking, which is weird considering it's been Beijing since 1945. I know it took a long while for everywhere to catch up, but by 1990 pretty much everyone was using Beijing. I guess they used an old atlas?
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:58:00 JST Foone🏳️⚧️
1. why does the PS/1 sound card use the gameport IO range?
2. WHY DID I HAVE TO READ THE DOSBOX-X SOURCE CODE TO FIND THIS OUT? -
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:58:01 JST Foone🏳️⚧️
my initial theory of how the code sharing went:
Prince of Persia ->
Where in the World is Carmen Sandiego (enhanced) ->
Where in the USA is Carmen Sandiego (enhanced) ->
Galleons of Glory: The Secret Voyage of Magellan -
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:58:01 JST Foone🏳️⚧️
1000:700b MOV CX,0x20
TimingLoop:
1000:700e LOOP TimingLoopahh, the good ol' days when "32 instructions" was a meaningful unit of time.
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:58:02 JST Foone🏳️⚧️
Total funcs: 762
Unnamed funcs: 293
% named: 61.5%118 of those named functions have been marked as identical to ones from Prince Of Persia (or vice versa... I have no idea which game had this code first)
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:58:02 JST Foone🏳️⚧️
63.9% named, and I'm up to 160 matching functions with prince.exe
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:58:03 JST Foone🏳️⚧️
I named this variable SoundBlasterPort but now, thanks to crossreferencing with the Prince of Persia disassembly, I know it's actually sound_blaster_port
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:58:04 JST Foone🏳️⚧️
here's a hint: that disassembly is from the EXE, not from the memory of a running program.
(why would that matter?)
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:58:04 JST Foone🏳️⚧️
@millihertz got it:
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:58:05 JST Foone🏳️⚧️
b8 13 29 MOV AX ,0x2913
50 PUSH AX
b8 00 00 MOV AX ,0x0
50 PUSH AXPOP QUIX: The usual way to zero out a register on x86 is XOR AX,AX. This'd be only 2 bytes (31 C0). The compiler knows this. Why didn't it use XOR AX, AX here, instead of the bigger MOV AX, 0x0?
(It's not because optimizations were off!)
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:58:06 JST Foone🏳️⚧️
this only happens with movable dialogs. unmovable dialogs don't flash black+white.
which makes me think it's a bug rather than an intentional decision
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:58:06 JST Foone🏳️⚧️
oh good lord. when you open the Hall of Fame window, it paints the background light blue, then loads the background image which overwrites the light blue with dark blue
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Friday, 30-May-2025 13:58:07 JST Foone🏳️⚧️
when it's trying to un-show a dialog box, it fills in the dialog box with black.
then white.
then it starts redrawing the background. -
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Jun-2025 12:32:47 JST Foone🏳️⚧️
broderbund::hide_cursor();
broderbund::show_cursor();WERE YOU PUNKS GETTING PAID BY THE CYCLE?
Haelwenn /элвэн/ :triskell: likes this. -
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Jun-2025 12:32:48 JST Foone🏳️⚧️
which is of course equivalent, but it means you get this code:
offset2_rect(-y - param_3->bottom,-x - param_3->right,
(Rect *)CONCAT22((char *)ds,¶m_3->bottom),
(Rect *)CONCAT22((char *)ds,¶m_3->bottom));instead of:
offset2_rect(-y - param_3->bottom,-x - param_3->right, param_3, param_3);
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Jun-2025 12:32:49 JST Foone🏳️⚧️
This normally would be invisible because all this happens over a single frame (or a couple), but running this slow makes it visible.
the GUI system they're using (I'm just calling it the broderbund UI in my reverse engineering work) DOES support avoiding this mess: you can tell it to hide the cursor, then when each sub-command tries to hide/restore it, it stays hidden, but they're not using it here. -
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Jun-2025 12:32:49 JST Foone🏳️⚧️
ghidra (at least in x86-16bit) mode, has a real annoying bug where it decides instead of just passing a pointer-to-struct as an argument, the code is passing a pointer to the first member of the struct, just cast back to a pointer.
-
Embed this notice
Foone🏳️⚧️ (foone@digipres.club)'s status on Monday, 02-Jun-2025 12:32:50 JST Foone🏳️⚧️
the mouse cursor appearing and disappearing is because they don't have multiple frame buffers: they have to hide the mouse cursor before they can draw anything, or the cursor would corrupt the newly drawn stuff if it happened to be over it.
so they solve this by hiding the cursor before every drawing command and showing it afterwards.but instead of doing it once per screen, they're doing it once per command.
-
Embed this notice