ioc.exchange is one of the many independent Mastodon servers you can use to participate in the fediverse.
INDICATORS OF COMPROMISE (IOC) InfoSec Community within the Fediverse. Newbies, experts, gurus - Everyone is Welcome! Instance is supposed to be fast and secure.

Administered by:

Server stats:

1.3K
active users

(Brazil has had 3/4 currency changes since then, depending on how you count it)

I'm thinking of dumping a list of all the hints in this game and calculating how many of them are wrong by now.

like, most of the flag clues. do you know how many countries have changed their flags since 1989? LOTS OF THEM

The description of Hungary says it's bordered by Czechoslovakia, Austria, Yugoslavia, Romania, and the Soviet Union.

Two of those are still right!

so I fly into Reykjavík, and immediately sleep for 8 hours. In the morning, I can go to either the airport or the hotel, but it'll take 3 hours to get to either.

Question: where am I right now, if I'm not at the hotel or the airport?

They initialized the SoundBlaster DSP backwards.
You're supposed to send a 0 to the reset port, wait 3 microseconds, send a 1, then wait up to 100 microseconds for an 0xAA to show up on the data port.

They instead send a 1, then a 0, then immediately start trying to read the data port.

they read from the ports instead of measuring time, because that'll take a certain amount of time on x86. I'm too tired to confirm if their timing logic is sound. It's possible they're just assuming the PC is slow enough that it'll wait long enough

I bet broderbund bought this sound code. It feels completely different: This was either compiled on a different compiler or was written in assembly.

yeah a compiler doesn't just start using CF to return bools instead of AX. This is assembly.

they're passing single bytes to functions! C widens integer parameters to a word, so on a 16bit system, they're passed in 16-bit registers.

they're sending a... internal soundblaster test command?
(DSP 0xF0)

I dunno why this code is like this.

I suspect there may be an issue here: I identified a variable as containing the Soundblaster IO port, right? and I'm assuming everything that uses it is Soundblaster code.

But it may just be "soundcard IO port" and there's other sound device code mixed in here. So that's why some of it doesn't make sense as soundblaster, it's actually tandy 3voice or something

I just found a function (inside another function!) that's a fixed delay. How long is it?
it's a loop that runs 256 times!

that's so cute that this code considers "256 instructions" to be a meaningful length of time.

there's code in here specifically to detect if it's running on an IBM PS/1 by looking at the CMOS area?

WHAT THE

the menu system limits menus to having a maximum of 32 items.

which is weird because ONLY 17 WILL FIT ON SCREEN

I did some experimenting with MSVC 5.1, and it's weird. I get the same strings in the exe as carmen.exe has, but the code itself looks completely different.

either I set up my compiler wrong, or this game is full of assembly even for very simple functions

I don't know exactly what this function does (I know it sets some flags based on something in the graphics context) but I DO know one important thing about it:

they included it in the final binary FOUR TIMES.

byte-identical.

this is a compiler & linker from 1988, it doesn't understand how to merge identical copies of functions apparently

I found another function which has 4 copies.

I'm starting to suspect this program originally had 4 C source files and the linker wasn't optimizing this

wait I bet it's drivers!
like, one version of this function is called by VGA_DrawFuncUnknown and nothing else.
Another one? CGA/Hercules.
the third? EGA
The last? Tandy.

They compiled the 4 video drivers separately, and then linked them into the EXE, with no deduplication across compile units

yeah. Found another: VGAMalloc is the same as CGAMalloc (and Hercules doesn't have it's own HerculesMalloc, because it's in the same code unit as CGA: So it just uses CGAMalloc)
Tandy has TandyMalloc.

But not EGAMalloc. That one is completely different.

the DrawLine API is weird.
To draw the horizontal underline for the hotkeys in the menu, it calls DrawLine(0, -width).

It's DrawLine(int y, int x), and yeah you pass negative numbers

it's also off by one.
because 0,0 is silly, you're always drawing at least one pixel. So DrawLine(0, -5) draws a six pixel wide horizontal line to the left

PUSH BX
PUSH ES
PUSH SI
CALL StartPlayingSound
POP BX
POP ES
POP SI

since when has the x86 stack been FIFO instead of LIFO?

the internal audio API used by this game is interesting.
LoadAndPlaySoundChunk is called with a chunk name from digisnd.dat, but you can also pass -1 or 0. I'm not sure what -1 does yet (maybe silence a currently playing sound?) but 0 means "wait until the sound finishes"

I'm not really sure why it works that way, especially because calling LoadAndPlaySoundChunk(0) is equivalent to calling WaitUntilSoundFinishes().

So why not just do that instead?

uh oh. the computer noise is triggered with:
LoadAndPlaySoundChunk(217)

but I look in the DIGISND.DAT file and it has chunks 200-216.

So either my DAT file parsing is wrong or it's loading sounds from elsewhere, somehow? because the sound DOES play, so it's not just an error

I thought it might just be playing from MIDISND.DAT instead (since the computer noise is very beepy, maybe it's just a synth sound?) but MIDISND.DAT starts at chunk id 218 and goes up.

WHERE IS 217?

huh. weird. when you try to backspace too far in the name entry screen, it goes "duh-nuh" at you, but that isn't connected to a LoadAndPlaySoundChunk call.

So it's using a different function for this ONE NOISE?

maybe it's hardcoded to pc speaker and I can't tell the difference between soundblaster and pc speaker because they're both coming out of the same laptop

YEP. muted my soundblaster (MIXER SB 0:0) and it's still duh-nuhing at me.

why would you do this to me, brøderbund?

ah-ha! I found 217.

DIGISND.DAT has PCM sound effects for 200-216.
But there's also chunks in CARMEN.DAT for 200-229.

I didn't think the ones in CARMEN.DAT were sound files because they're so small... but they're just the right size to be PC speaker sound effects!

the way the game works is that it loads CARMEN.DAT always, then if you have a sound card it supports, it loads DIGISND.DAT which replaces chunks 200-216 in memory with the DIGISND.DAT ones, which are PCM. But if you don't have a sound card, it still has the CARMEN.DAT ones loaded, and they're all pc speaker sound effects.

they hardcoded two sound effects into the EXE and the rest are loaded from the DAT files.

eww. Someone hacked something in at the last moment!

yeah lets just return 17 bits from this function WHY NOT there are no rules

correction correction: 49 bits

did some stats:
there's 729 functions in the EXE.
I've named (in some way, counting placeholders) 355 of them, or 49%

by placeholders I mean things like "pcjr_sound_related" or "VGAFunc8"

and 13 of those function names include the word "maybe"

Andrew Zonenberg

@foone Sounds like most of my IDBs.

"UART_func4", "Socket_func2"