Topics

https://github.com/xor2003/masm2c/issues/10#issuecomment-1037026893

For example I already ported Test drive 3...

Reverse engineered and C ported MT15.DRV (MT32-Sound-Driver) of Stunts 1.0 and 1.1

• Assembler source can be rebuild to 100% binary exact version of the original
• Assembler can be partially mixed with C ported functions or all functions can be replaced by C code

Reason for doing it:

Stunts 1.0 MT15.DRV seems to sound better than the 1.1 version (some strange slowdowns happen)
i just wanted to understand what the differences are and how to port that stuff to C

Result: the timing code is different - but only some lines of assembler nothing big

https://github.com/LowLevelMahn/UnifiedMT15

did you already used the #ifdef define/conditional assembling stuff for these changes?
and are you a git crack now?

https://www.reddit.com/r/REGames/comments/qmqq3g/systematic_method_to_reverse_engineer_and_rewrite/

We could do something similar with a dosbox backend, istead of reversing all in a dos environment its possible to replace parts of the code with full 32/64bit c code, until the point everything is ported

MD15.DRV "Versions" in several DSI games

Code Select Expand


Game                                   ~Release    Filesize MD5

Stunts 1.0                             11.10.1990  1667     7048D28F2A0FE8C8C09141D5C89706DB <- Part of my Reversed-MT15.DRV Projekt
4D Sports Boxing 1.0                   05.10.1990  1667     7048D28F2A0FE8C8C09141D5C89706DB
Bill Elliotts Nascar Challenge         ~1991       1667     7048D28F2A0FE8C8C09141D5C89706DB
Stunts 1.1                             ~1991       1750     ACC5D03D038F1EF0AFA0CF4DCAD72EF9 <- Part of my Reversed-MT15.DRV Projekt
4D Sports Boxing 1.1                   22.04.1991  1788     B17BBC19ED37C9413DD68E20D4D9848F - Sounds correct with Stunts!
Mission Impossible                     22.04.1991  1788     B17BBC19ED37C9413DD68E20D4D9848F - Sounds correct with Stunts!
World Tour Tennis                      ~1993       1789     53F6BCAEBC097893868C69CE994A3321 - Sounds correct with Stunts!
4D Sports Tennis                       03.03.1992  1789     53F6BCAEBC097893868C69CE994A3321 - Sounds correct with Stunts!
Michael Jordan in Flight               21.12.1992  1813     372ED87FEE4FB0762D2531DC8BB34337 - Sounds correct with Stunts!
The Simpsons: Barts House of Weirdness ~1991       1982     8326A348DCC756EEB77466AD53F742EA - Sounds correct with Stunts!


would be interesting to check:
-what are the additional bytes in the other versions (more Data, more Code?) i thinks mostly timing code differences (primary bug source)

btw: nearly equal size does not mean small differences

http://wiki.stunts.hu/index.php/Game_versions

i try to find ORIGINAL floppy images of all the Stunts versions

Brøderbund versions (referred to as BB versions)
  Stunts 1.0 (05 Oct. 1990)
  Stunts 1.1 (12 Feb. 1991)

Mindscape versions (referred to as MS versions)
  4D Sports Driving 1.1 (13 Dec. 1990)
  4D Sports Driving 1.1 (25 Feb. 1991)

there are several download pages with images - but sometimes complete without version info or partially cracked etc.

anyone with the pure unmodified floppy images around?

for my reverse engineering fun projects

my MT15.DRV reverse engineering project goes very well - when i find free time to work on it

DONE:

• fully disassembled Stunts 1 and 1.1 MT15.DRV with script based building and binary comparison to original drivers - producing 100% identical drv files
• build flags to keep the drvs binary compatible or to allow remove of dead code/data etc.
• C/asm stubs, my base for the C port - does mimic the original drv layout for beeing loadable - also builded with scripts

i've found some functions that are not in use (dead code) in both drv versions, and init data that is also not used
its very relevant for the C port to test these "cleaned-up" versions if there is anything strange happen (both work on my side so far)

attached are the re-assembled versions without the dead code/data stuff
anyone interested in testing?

NEXT:

• more analyse of the parameter/data-segment dependencies in the functions, use constants for Port/IO/MPU401 port accesses, more documentation
• combine the two driver versions into one asm source - with a flag to switch between versions - but still 100% identical drv files in the end - for history preserving reasons
• port that old dirty asm over to C - at this point only function identical - binary equality is hard to reach using a C compiler
• understand the known bug in the 1.1 version
• port the other drivers also this way

im using Dosbox Staging for testing - the lastest development version integrates the MT32 stuff so its easier to get it going
download the alpha here if you got a github account: https://dosbox-staging.github.io/downloads/devel/ (clicks windows link and the the bottom dosbox-staging-windows-x64-v0.77.0-alpha-856-g2e93f file)

your dosbox staging config should then contain

[midi]
mididevice=mt32

[mt32]
romdir=rom-dir #  use the mame roms
model=mt32_old # for original stunts release version of MT32
#model=cm32l_102 # or the new one

https://www.accursedfarms.com/forums/topic/2467-rosss-game-dungeon-test-drive-3/page/5/?tab=comments#comment-219733

Blender File:
http://dustinfischer.net/Pacific%20Yosemite.blend

Loaded in Blender
https://pasteboard.co/JkolyQp.png
Rendered:
https://pasteboard.co/JkonzCY.png

would be great to have something similar for Stunts - and then a Stunts Movie

examples:
"What is the title of track #216?"
"Who won season 2017"

i have no idea how to solve such questions... maybe a little bit too strong for interested people

its some sort of Dosbox but based on Fake86 (http://sourceforge.net/projects/fake86/) and only able to emulate the environment enought to run stunts

the zip contains 3 files

game_pc.exe - the 16bit dos game, build with clvn's execombiner and my own sound driver integration tool for pc-speaker sound
stuntsvm.exe - executes/emulates game_pc.exe
SDL.dll - for Keyboard/Mouse/Gfx (https://www.libsdl.org/)

copy these into your stunts directory (where the tracks, sound and others files are - but make a backup before) and run stuntsvm.exe

what can you do with stuntsvm - test and play - for me its the base of my statical recompilation ideas for stunts

i've installed stunts under

latest fake86 (http://sourceforge.net/projects/fake86)
DosBox 0.74 (dosbox.com)
VMWare Player 7 + MsDos 6.22

and i've get different start positions when just starting the game and fo directly to race

fake86/VMWare showing equal start screen, dosbox a different

why is that - is it a bug?

i talk about the exe result of clvns execombiner - so no code modification

i don't know if it is a known problem also with unmodified stunts - but i get sometimes (svn version) dosbox debuger illegal instruction breakdowns
or my vmware player (v6) totaly crashed with illegal instructions message

it mostly happens when you start a race and directly crash into a wall - anyone else got this problem (very rare)?

i've developed a tool that combines the stunts game.exe with the ad15.drv (adlib/soundblaster) driver (but pc15.drv is also possible)
parts of the game getting patched for disableing the driver (un)loading

why (still same reasons):
-for fun
-reduce the amount of runtime loaded code down to 0% (hope that is reached now) - IDA likes it more then

seems to work perfectly - someone want to try?

just copy the attached game_drv.exe into your stunts1.1 directory and start without commandline parameters

[BIG TODO]

i've developed a small C/C++ program that attaches the ad15.drv to the stunts game exe

how is it done:
-attached block of 0x00 in size of former uninitialized data to image
-attach drv code
-add new entry for driver-ptr adjust to relocation table
-change position of stack
-change header sizes

result:

IDA can now fully analyse the code of the sound driver in new seg042

why:
1. just for fun
2. reduce the amount of runtime loaded code further (should be now down to 0%) - so IDA can work better
3. just the next step to my 16bit->32/64bit translation idea


but ... BIG TODO - thats why i named the post "first steps..."

1. fix stunts crash "memory manager - BLOCK NOT FOUND at SEG=37eb" at startup - does the stunts code rely more on the image layout then i thought?
2. patch the driver loading code that the attached code is used instead of runtime loading

clvn, dstien, w4kfu - please help...

http://forum.stunts.hu/index.php?topic=2454.msg44125#msg44125

(this is my first "try" of getting into reverse engeneering the game)

i just found out that load.exe is exepacker based
and can be easily uncompressed with UNP (in zip-archive \unp412b)

and i reduced the normal stunts11 package to the minimal amount of files
(data and "executables") needed to run the game (without the anti-password-crack, setup stuff)
so its easier to use an debugger or disassembler (http://www.hex-rays.com/idapro/idadownfreeware.htm) on it
and the dosbox debugger could also help: http://vogons.zetafleet.com/viewtopic.php?t=3944

in the load.asm file is an first-shot-listing from ida freeware

just use start.bat to start the game - happy opcode extracting