YEP. muted my soundblaster (MIXER SB 0:0) and it's still duh-nuhing at me.

why would you do this to me, brøderbund?

ah-ha! I found 217.

DIGISND.DAT has PCM sound effects for 200-216.
But there's also chunks in CARMEN.DAT for 200-229.

I didn't think the ones in CARMEN.DAT were sound files because they're so small... but they're just the right size to be PC speaker sound effects!

the way the game works is that it loads CARMEN.DAT always, then if you have a sound card it supports, it loads DIGISND.DAT which replaces chunks 200-216 in memory with the DIGISND.DAT ones, which are PCM. But if you don't have a sound card, it still has the CARMEN.DAT ones loaded, and they're all pc speaker sound effects.

they hardcoded two sound effects into the EXE and the rest are loaded from the DAT files.

eww. Someone hacked something in at the last moment!

yeah lets just return 17 bits from this function WHY NOT there are no rules

correction: 33 bits

correction correction: 49 bits

did some stats:
there's 729 functions in the EXE.
I've named (in some way, counting placeholders) 355 of them, or 49%

by placeholders I mean things like "pcjr_sound_related" or "VGAFunc8"

and 13 of those function names include the word "maybe"

up to 52% after today's work

I think they generated their hints wrong.
The *22 chunk for a city says something like "$SUSPECT was going to an opera with the president" or "$SUSPECT would be having tea with the Emperor", right?

but it's also got "drove away in a vehicle flying a green, blue, and yellow flag". which'd be fine, except that hint is also in *19!

I think they accidentally duplicated it when they generated the cities.dat file

this causes a glitch in the game where you can have 2 of your 3 informants give you the same flag-color hint, which is less than useful

ugh. ghidra really doesn't understand that you can call far functions using near calls.

and the compiler for this LOVES using them.

I might have explained this before, but normally a near call to a far function will break, because it'll pop 4 bytes off the stack for the return address, when the near call only pushed 2.

So you fix this by doing push CS first, so it'll pop the 2 from the call, and then the 2 you placed before.

but ghidra doesn't understand that this is what's happening, so it hallucinates it as a parameter to the function that's CS.

so you'll see, for example, it decompiles a strlen as:

uint1 = strlen(0x1000, some_String);

which is less than useful

this is "thing 9005 that you don't have to worry about anymore, thank fuck"

in 32bit we do 32bit calls and 32bit returns.
in 64bit we do 64bit calls and 64bit returns.

in 16bit we can do 16bit calls and 16 bits returns, 32bit calls and 32bit returns, and sometimes we do a 16bit call to a 32bit return because it's slightly fewer bytes

one of my favorite stupid methods of reversing is "break it"

what's this function do? well, lemme disable it, and see what breaks.

Apparently this is the "restore the image under the cursor" function.