@delan@kolektiva.social + cohost.org/delan

@dazabani

interesting call. some kind of runtime function pointer?

06/12/2020, 9:18:03 pm 🔗

Favs: 2

Retweets: 0

@delan@kolektiva.social + cohost.org/delan

@dazabani

that rabbit hole only ended up leading to a handful of LoadCursorA and SetCursor calls, and it turns out the return value only matters in pick a puzzle mode. but what about these other three functions?

06/12/2020, 10:28:57 pm 🔗

Favs: 1

Retweets: 0

@delan@kolektiva.social + cohost.org/delan

@dazabani

one of them definitely fetches the puzzle customisation states for each category (0 = on, 1 = off by user, 2 = done and permanently off), and does… something with them.

i’m gonna call it a night, but we’re getting closer!

06/12/2020, 11:41:44 pm 🔗

Favs: 2

Retweets: 0

@delan@kolektiva.social + cohost.org/delan

@dazabani

day 2.

so the addresses of the puzzle cust’n states for each category are 11 qwords apart, going by the SIB, but maybe they’re 44 words apart? if we use the first word for that state, that leaves… 43 words. how many puzzles does the biggest category have? c;

07/12/2020, 7:45:38 pm 🔗

Favs: 2

Retweets: 0

@delan@kolektiva.social + cohost.org/delan

@dazabani

at first i was sad that my idea didn’t work out, but no, there really is a bool puzzleDone[43] (int in turbo C++?) *before* each puzzle cust’n word.

gonna keep an eye out for both C6h and 70h (C6h − 43 words) going forward. or maybe set some watchpoints?

07/12/2020, 8:19:03 pm 🔗

Favs: 1

Retweets: 0

@delan@kolektiva.social + cohost.org/delan

@dazabani

made a huge amount of progress today, to the point where i’ve got a rough idea of how the puzzle RNG works!

1. determine which categories are viable
2. select a random viable category
3. find up to three candidate puzzles
4. select a random candidate puzzle

08/12/2020, 12:31:49 am 🔗

Favs: 0

Retweets: 0

@delan@kolektiva.social + cohost.org/delan

@dazabani

high level IL mode really overcomplicates this with the repetition and questionable register splitting.

1. categories.filter(.customisation == 0 or 3)

2. result[rand() % n]

what does puzzle cust’n 3 mean? and what happens in the endgame? we’ll come back to these questions.

08/12/2020, 12:53:05 am 🔗

Favs: 0

Retweets: 0

@delan@kolektiva.social + cohost.org/delan

@dazabani

more questionable splitting. i really wish i could tell binja to split a local variable at some IP.

3. candidates are the first three (or up to three) unsolved puzzles in the given category (non-endgame), or just a single candidate puzzles[rand() % n] (endgame)

08/12/2020, 1:02:49 am 🔗

Favs: 0

Retweets: 0

@delan@kolektiva.social + cohost.org/delan

@dazabani

4. candidates[rand() % n]

when there are only six unsolved puzzles (checked every step 3), the player enters the endgame, and all categories get their puzzle cust’n set to 3. we already know about the non-endgame states:

0 = on
1 = off by user
2 = off and locked (fully solved)

08/12/2020, 1:14:17 am 🔗

Favs: 0

Retweets: 0

@delan@kolektiva.social + cohost.org/delan

@dazabani

endgame introduces two new states (ignore the puzzles done column, which i cbf updating):

3 = on (endgame)
4 = off (endgame)

08/12/2020, 1:32:38 am 🔗

Favs: 0

Retweets: 0

@delan@kolektiva.social + cohost.org/delan

@dazabani

so that’s roughly how the puzzle RNG works, but i’ve only covered the *read* side of the puzzle state.

to figure out how my puzzle cust’n trick works (and why i can no longer execute it), i think we’ll need to understand the *write* side too.

but for now, let’s call it a night!

08/12/2020, 1:43:39 am 🔗

Favs: 0

Retweets: 0

@delan@kolektiva.social + cohost.org/delan

@dazabani

day 3.

let’s figure out what happens when you solve a puzzle, and why it doesn’t always seem to get marked as solved.

here’s where we do the latter. notice 6Eh rather than 70h, because SsgSelectedPuzzle is 1-based! and here’s a function that probably just plays a sound.

08/12/2020, 8:38:53 pm 🔗

Favs: 0

Retweets: 0

@delan@kolektiva.social + cohost.org/delan

@dazabani

day 4.

the plan is to play around with selecting and solving puzzles, with the help of this huge library of save files i’ve been accumulating over the course of this year.

if we can map out all of the state involved *and* how it’s manipulated, we might be able to find the bugs.

12/12/2020, 4:31:26 pm 🔗

Favs: 0

Retweets: 0

@delan@kolektiva.social + cohost.org/delan

@dazabani

starting with my example on http://speedrun.com, i remembered this being bugged every time i loaded it, but now? no luck.

i hope this isn’t a 1.12 ↔︎ 1.2 thing, because i have no idea how i would debug 1.12 running in a win98 guest.

https://www.speedrun.com/x/thread/2v06i

12/12/2020, 6:10:35 pm 🔗

Favs: 1

Retweets: 0

@delan@kolektiva.social + cohost.org/delan

@dazabani

i tried everything i can think of, but i guess it’s time to switch back to 1.12.

holy shit, even ollydbg 2 still supports win98 (and win95), as long as you bring your own unicows!

https://web.archive.org/web/20030416152601/http://www.microsoft.com/globaldev/handson/dev/mslu_announce.mspx

12/12/2020, 7:48:50 pm 🔗

Favs: 0

Retweets: 0

@delan@kolektiva.social + cohost.org/delan

@dazabani

win98 + 1.12 actually runs much faster than win10 + 1.2 for me. beware: the audio stack doesn’t like being paused by breakpoints too much, so you’ll often run into these or hangs… but on win98, hang = reboot and lose all your ollydbg settings since the last clean exit.

12/12/2020, 8:14:57 pm 🔗

Favs: 0

Retweets: 0

@delan@kolektiva.social + cohost.org/delan

@dazabani

no luck reproducing any puzzle RNG bugs tonight on any of my guests, including three win98 (vmx5 + vmx9) and two win95 (vmx5). i think i’m gonna call it a night!

12/12/2020, 9:38:04 pm 🔗

Favs: 0

Retweets: 0