Alice Averlong🏳️⚧️oh this is a weird thing I didn't know existed.
you embed an int3 in your code, then a short JMP, and the ASCII characters "WVIDEO".
If the ASCII code is found, it ends up outputting a debug string in the Watcom debugger.
not, like, an index into which background, but the background ITSELF
correction: that's now 100%
it definitely does.
I can load the game, move left and right, then save the game.
this'll export the current background to a file
it's 256-color, and there's 43 palettes here. a bunch of them are similar so I can't just match them manually
my wizards-apprentice script keeps trying to open my text editor
why
what is there for you in the hex editor, keyboard/mouse macro?
You can't tell where the cursor is! you can't consistently move it, either!
so I can't even set up a standardized memory location to spy on, since it changes every time I reboot DOSBox
A tcp/ip protocol for doing things like reading/writing memory and saving/loading savestates and providing input (keyboards, mice, controllers)
then go around and implement it in a bunch of emulators
or maybe I just need to stop restarting DOSbox.
it's 0x1001000 bytes long, which is a bit more than 16mb.
memsize=16 (mb)
okay I confirmed this works manually. I can find the new DOS-RAM section, add 2304500 to it, and I get the x-pos of the cursor.
now to do it automatically.
I was kinda hoping there was an API that let me point at a process and go "hey what memory regions does this have mapped?"
NOPE
it's pretty simple.
you start at 0, and call VirtualQueryEx at that address.
so you just call VirtualQuery repeatedly on a ton of memory addresses.
why not
got it. hacked a bit on this script and now I have a script that takes a PID and tells you the address of the DOS RAM in that process:
https://github.com/nccgroup/memaddressanalysis/blob/master/Windows/memanalysis.py
the only problem? I don't have their palettes yet.
or rather, I do have their palettes, but I don't know which palette goes with which background.
most look "decent", but a bunch of clearly wrong.
the CB and CCS databases seem to reference palettes (or at least backgrounds), so one of them must be the datafile I'm looking for.
OH NO
I just realized my computer crashed earlier and I had ghidra open. I may have lost all my reverse engineering work ;_;
CCS I think is for scripts.
oh god I do not want to decode the scripting language this thing uses. it has a big interpreter here and it's huge
instead of putting them at standard positions in the palette, every time it loads a palette, it goes through all the palette entries and finds the color that's closest to that shade of grey.
The three shades are: black, rgb(161,161,161), and white.
huh.
I found the font renderer.
I wasn't even looking for one! this isn't a death generator thing!
but you can't stop Foone from Fooning
it calls malloc for every character it draws?
huh.
twice.
Inari 
uhh.
I don't see any free()
Dennis
phnx, abandoned account
nil 
I mean it's only allocating like, 24 bytes per character?
and this game has VERY little text.
but still.
StackFuckerOrigins
StackFuckerForever
probably because they were originally only called from functions that no longer have any contents, thanks to a define.
this code appears to be strlen but it seems to count backwards from -1 and then inverts it at the end?
the fuck?
Biason::Julio::new();
Adrian O’Connor
Markus F. FrischLooks fun - where did you find that?
Bruce Prestonthis is weird. the "Load_Dialogues" function tries to load .ccb files.
but there are no CCB files on the retail disc. Did... did they forget to include the dialogue files? IS THIS WHY THE GAME HAS NO SUBTITLES?
so the game has no "new_game" function.
instead, if you select "new game", it loads a special savegame named "new.can"
Lothus Marque
Mr. Fred 🔥
Will Blantontime to see if I can run this on slow-ass mode
I don't know numbers, I know filenames
I run memdumpbin on what I can see in the debugger, it tells me "Memory dump binary success", and creates a file with 0 bytes in it.
weird.
HenriHave you thought about using QEMU and GDB instead of DOSBox?
https://astralvx.com/debugging-16-bit-in-qemu-with-gdb-on-windows/
Lorenzo Miniero
Martok@foone Unconventional choice of 16-bit lengths (wait, is this 16 bit?), but otherwise I'd guess this is the equivalent of
for (unsigned int count=0; count<0xffff; count++) {
if (param_1[count] == '\0') break;
}
return count;
Except with the compiler changing array index to moving pointer and inverting the loop because testing for 0 is faster than equality. Used to be a pretty normal thing Borland compilers do, IIRC?
And yeah, 2's complement at the end is just a faster imul -1.
nick
The All-Knowing Cheese AIthanks.
taber
Hayley Question-Mark
Rather Not
Palmer Dabbelt
Chartreuse
Carl Tessier
BBQDeveloper 
🔞 
PCLMULQDQ
Ozzelot