wait is this image format vertically interlaced!?

It loads the half-width version, then a few functions later, it's been replaced with a full-width version.
Strange!

wait no, the colors are wrong... I bet I'm seeing it decompress the binary, but that's using the full width of the bytes. it then gets expanded out to a 16-color image.

well the good news is that I think I've found the decompress_image function. the bad news is that now I have to reverse engineer it

it's currently doing the obvious thing for a decompressor to do:
write the byte 04 every 69 bytes

oh sweet jesus, that's the left two pixels of the image.
it's loading the image vertically!

at least it's top to bottom.

yeah, doom did that too, but Doom was a 2.5D image that had to do pseudo-raycasting.

THIS GAME DOES NOT

it allocates a 1024 byte buffer, then makes a pointer to the end of it, minus -0x42?

why would you need a link to the end of a new, freshly cleared buffer, minus 62?

I think the memory allocation system here is that every malloc returns 2 extra bytes, which is a pointer to the previous block.
unless it's an odd number, in which case it's a free block. and pointer to the previous block, once you make it even again

I hate dealing with the internals of memory allocation systems. I prefer to leave that to smarter people than me

You see this little About dialog box? Guess how many times the DrawText function is called?

Once! and just to draw "Where in the World is Carmen Sandiego?".
The rest of the text is draw elsewhere, and I have no idea why.

correction: it calls it once to draw "Where in the World is Carmen Sandiego?" but that's unrelated to the one on screen WHAT?

Ahh, it's using a different version of the DrawFont call: DrawFontN

the only problem with using Ghidra to hack children's games instead of, like, Serious Things like firmwares or malware or whatever, is sometimes you have to make a label named NUM_MOUNTAIN_CLIMBING_HINTS

(the number of mountain climbing hints is 3, by the way)

I think I accidentally hacked my debugger

It has a surprisingly robust UI engine. I swapped from BoldFont to SmalFont and the menu adapted perfectly.

The game loads the BoldFont first, then the SmallFont, then the NormalFont.

Annoyingly this isn't how they're laid out in memory:
It's SmallFont, then BoldFont, then NormalFont

Weirdly, swapping the NormalFont for the SmallFont causes the printer text to be VERTICAL, for reasons I do not remotely understand!

font_alloc = malloc(local_a);
if (font_alloc == (void *)0x0) {
font_alloc = (void *)0x0;
}

Ahh yes. remember, if you get a null pointer back from malloc(), make sure to set that variable to NULL so it won't be left as... NULL?