correction: 33 bits

correction correction: 49 bits

did some stats:
there's 729 functions in the EXE.
I've named (in some way, counting placeholders) 355 of them, or 49%

by placeholders I mean things like "pcjr_sound_related" or "VGAFunc8"

and 13 of those function names include the word "maybe"

up to 52% after today's work

I think they generated their hints wrong.
The *22 chunk for a city says something like "$SUSPECT was going to an opera with the president" or "$SUSPECT would be having tea with the Emperor", right?

but it's also got "drove away in a vehicle flying a green, blue, and yellow flag". which'd be fine, except that hint is also in *19!

I think they accidentally duplicated it when they generated the cities.dat file

this causes a glitch in the game where you can have 2 of your 3 informants give you the same flag-color hint, which is less than useful

ugh. ghidra really doesn't understand that you can call far functions using near calls.

and the compiler for this LOVES using them.

I might have explained this before, but normally a near call to a far function will break, because it'll pop 4 bytes off the stack for the return address, when the near call only pushed 2.

So you fix this by doing push CS first, so it'll pop the 2 from the call, and then the 2 you placed before.

but ghidra doesn't understand that this is what's happening, so it hallucinates it as a parameter to the function that's CS.

so you'll see, for example, it decompiles a strlen as:

uint1 = strlen(0x1000, some_String);

which is less than useful

this is "thing 9005 that you don't have to worry about anymore, thank fuck"

in 32bit we do 32bit calls and 32bit returns.
in 64bit we do 64bit calls and 64bit returns.

in 16bit we can do 16bit calls and 16 bits returns, 32bit calls and 32bit returns, and sometimes we do a 16bit call to a 32bit return because it's slightly fewer bytes

one of my favorite stupid methods of reversing is "break it"

what's this function do? well, lemme disable it, and see what breaks.

Apparently this is the "restore the image under the cursor" function.