[NY00123]

Hendricks266, on 23 May 2017 - 08:49 PM, said:

1. I have the original file modification timestamps for all eight of the betas. I could always `ls -R` them, but I would like to post this information in a way which can easily be reapplied to the files. I also need to do research into how time zones and DST affect the time values. I welcome any advice anyone has with this.

It is great to see you still have these! Here are my comments on this for now:

1. Compared to "ls -l", "ls --full-time -l" increases the displayed precision of the timestamps.
2. I'm afraid that ZIP files (and possibly also old DOS-based installers) preserved the times without any timezone information. So basically, local timezone was assumed. As long as the TZ does not change for every of the involved PCs (during the lifetime of the data on each such PC), there should theoretically be no issue.
3. Also note that, as it turns out, 7Zip may extract the files (or at least some of them) with an offset of an hour or more in the times, compared to Info-ZIP's unzip. This may also explain why you might get the same thing with UI-based archivers like "file-roller". Thus, making sure the exact same archiver is used is also important (although using a specific archiver in each computer may also do the job).
4. As for a way to post the information, maybe you may create simple txt files with the data, along with some script that can apply the times to the files? Note that for the sake of simplicity, I'm thinking about Linux/Mac only atm (and local timezone should be assumed/used).

[Player Lin]

PikaCommando, on 24 May 2017 - 06:00 AM, said:

Oh hey, the documentation on first 1995 build's is up on TCRF.

About the Debug counter one, I'm guessing it means player's health, as I found later builds, its value matches the HUD's player health value, but I'm not sure. As the 950115 build do not have anything to hurt player...

EDIT : I checked the 1994 page in TCRF, I notice the dead man(red cloth one) in HUD looks familiar to the this one, also black heir and red cloth, the gold part maybe is skin as looks like he/she(?)'s dead, and cloth just ragged...but that's just my speculation... :\

[Jimmy]

The problem with making a mod for Shadow Warrior is you have no ability to program anything, so you're only left with asset swapping. This was a major mistake on 3DR's part.

[PikaCommando]

Did some animations with the '94 sprites.








Also, looks like the the '95 Ninja could use the Crossbow as well.

[PokeThePower]

I can't remember whether it was Wanton or Cryptic Passage but one of them we wound up having to have our own executable in order to change the episode names/missions launched. Made for a mess in terms of people running different patched versions of the game.

Regardless, with the source code out you *could* add some form of support mod DLLs. I haven't looked at the state of the SW ports to see how reasonable that would be.

[Daedolon]

Cryptic had an executable for swapping the art and ini file, yeah. Basically just did this on launch and reverted on exit:

REN TILES007.ART TILES007.ORIG
REN TILES015.ART TILES015.ORIG
REN BLOOD.INI BLOOD.ORIG
REN CPART07.AR_ TILES007.ART
REN CPART15.AR_ TILES015.ART
REN CRYPTIC.INI BLOOD.INI

[icecoldduke]

NeverSawFreeWilly, on 24 May 2017 - 11:05 AM, said:

I can't remember whether it was Wanton or Cryptic Passage but one of them we wound up having to have our own executable in order to change the episode names/missions launched. Made for a mess in terms of people running different patched versions of the game.

Regardless, with the source code out you *could* add some form of support mod DLLs. I haven't looked at the state of the SW ports to see how reasonable that would be.

Separating out the game code from the exe would not be hard to do(just really time consuming). I can add this to my todo list if you guys want it.

[LeoTCK]

icecoldduke, on 24 May 2017 - 06:43 AM, said:

That's probably all the content they had done at the time.

It amazes me how games shipped back in the 90's. It seems like Shadow Warrior rebooted itself to a smaller scoped project half way through development(which is good because I like the final iteration best, even if the levels in prior builds had a smoother gameplay flow).

No, they had more as shown on those early released screenshots. But sometimes some maps don't end up in test alphas and are only kept in working directories in practice. When I got various Unreal builds out of recovering a cancelled game on the engine, I mostly got just the plain game/editor builds with it but the maps were distributed separately unless it was some milestone testing beta which I never got.

Sometimes recovering stuff gets more difficult because of all that and that often the developement was more "disorganised" than some more modern games. Within the context it all makes sense.

[PokeThePower]

Daedolon, on 24 May 2017 - 11:10 AM, said:

Cryptic had an executable for swapping the art and ini file, yeah. Basically just did this on launch and reverted on exit:

Ahhh... it was probably Wanton then and those changes never made it out into the wild. I was doing hand edits to the exe binary and had to work within the character limit of the item I was replacing since of course to change the EXE file size would cause it to fail to run.

icecoldduke, on 24 May 2017 - 11:42 AM, said:

Separating out the game code from the exe would not be hard to do(just really time consuming). I can add this to my todo list if you guys want it.

As a purely principle of the matter exercise I'd feel the good kind of envy over you getting to scratch that itch.

[icecoldduke]

LeoTCK, on 24 May 2017 - 12:09 PM, said:

No, they had more as shown on those early released screenshots. But sometimes some maps don't end up in test alphas and are only kept in working directories in practice. When I got various Unreal builds out of recovering a cancelled game on the engine, I mostly got just the plain game/editor builds with it but the maps were distributed separately unless it was some milestone testing beta which I never got.

Sometimes recovering stuff gets more difficult because of all that and that often the developement was more "disorganised" than some more modern games. Within the context it all makes sense.

The question is, were these builds released externally(in which case I agree with you) or were they snapshots of someones harddrive?

[MajorTom 2417]

PikaCommando, on 24 May 2017 - 10:48 AM, said:

Did some animations with the '94 sprites.








Also, looks like the the '95 Ninja could use the Crossbow as well.

so it was the '95 version that had the crossbow? Sorry I keep asking about it....it's just that so few non-medieval FPS games have good crossbows in them.

[LeoTCK]

icecoldduke, on 24 May 2017 - 12:16 PM, said:

The question is, were these builds released externally(in which case I agree with you) or were they snapshots of someones harddrive?

We don;t know, but fact is especially early on you hardly get complete betas or alphas especially in that time when they had to show it on floppies or whatever. Sometimes one set of maps would end in one and another set in the other. Just speaking by experience in these matters and having seen many dev builds of Unreal/derivative games and Daikatana for example, with that other maps often came separately uncompiled or whatever and were only compiled whenever the team needed to.

Even in full betas sometimes they had something done but decided to not include for the moment even if final game had it in the end.

EDIT: zeur suggests that we could contact the company that issued the dongle (for the '95 beta), if it still exists in some form. To inquire if they kept archives. If so, the current owner of Apogee could possibly authorize them to give us either a dongle to analyze, or to document to us the encryption method and key. It's a long shot but if that's all there is, we should try it.

[icecoldduke]

LeoTCK, on 24 May 2017 - 12:27 PM, said:

EDIT: zeur suggests that we could contact the company that issued the dongle (for the '95 beta), if it still exists in some form.

Early on in my career I had to do something similar and we found dongles from 98 or 99 that had a custom decryption key built in, so just buying a brand new one from the manufacture wouldn't cut it if thats the case.

[LeoTCK]

The manufacturer would have programmed the key in - in this case (maybe). Besides, even having that particular type - the number is visible in the executable - would help.

EDIT: I didn't discover that myself, you can thank Bryan for pointing out that the serial number and all is in there.

EDIT2: That serial number seems high enough to not be a model number and low enough that it wouldn't identify a particular dongle. Zeur surmises that all dongles with the key we're looking for had that SN printed on it.

EDIT3: Speaking of Bryan, he wanted me to relay his apologies to everyone on the forums and that he's changed since. He'd like to join on the discussion.

[PikaCommando]

Major Tom, on 24 May 2017 - 12:22 PM, said:

so it was the '95 version that had the crossbow? Sorry I keep asking about it....it's just that so few non-medieval FPS games have good crossbows in them.

I don't think it's functional, but it has the sprites for the crossbow in first-person.

[Hendricks266]

LeoTCK, on 24 May 2017 - 02:23 AM, said:

Alright. Well, the 94 engine looks way less than actual build though, it looks more like kens labyrinth or something.

It has three years less development, but it's definitely Build.

MrFlibble, on 24 May 2017 - 04:37 AM, said:

Is it me, or does the music sound somewhat similar to the song from Ken Silverman's Build engine demo?

See _note.txt, as well as the TCRF article.

PikaCommando, on 24 May 2017 - 10:48 AM, said:

Did some animations with the '94 sprites.

Cool, but you forgot to take the x- and y-offsets into account, so the animations are jerky. (For example, someone moving their arms while standing still might appear to float left/right/up/down erratically.) It might also be easier to view them if you slow the frame rate.

NeverSawFreeWilly, on 24 May 2017 - 11:05 AM, said:

I can't remember whether it was Wanton or Cryptic Passage but one of them we wound up having to have our own executable in order to change the episode names/missions launched. Made for a mess in terms of people running different patched versions of the game.

It was Wanton. Twin Dragon did the same thing, and so will Deadly Kiss.

Blood lets you set episode and level names from an INI file.

LeoTCK, on 24 May 2017 - 12:27 PM, said:

EDIT: zeur suggests that we could contact the company that issued the dongle (for the '95 beta), if it still exists in some form. To inquire if they kept archives. If so, the current owner of Apogee could possibly authorize them to give us either a dongle to analyze, or to document to us the encryption method and key. It's a long shot but if that's all there is, we should try it.

I somehow doubt they're still around, but this is a valid point, thanks.

It's also possible that some of the original dongles still survive.

LeoTCK, on 24 May 2017 - 01:06 PM, said:

The manufacturer would have programmed the key in - in this case (maybe). Besides, even having that particular type - the number is visible in the executable - would help.

We have a text document with Apogee's secret key as well as the encryption/decryption utility. All we're missing is the physical hardware. Interestingly, you don't need the dongle to be present in order to encrypt something.

LeoTCK, on 24 May 2017 - 01:06 PM, said:

EDIT: I didn't discover that myself, you can thank Bryan for pointing out that the serial number and all is in there.

EDIT2: That serial number seems high enough to not be a model number and low enough that it wouldn't identify a particular dongle. Zeur surmises that all dongles with the key we're looking for had that SN printed on it.

Yep, I remember finding that in the exe and noting that it was quite a low number.

*** ÆGIS v5.0 Copyright © Software Security, Inc. 1991, 1992, 1993 *** Serial#: SSI/00000612 Customer: APPOGEE SOFTWARE *

LeoTCK, on 24 May 2017 - 01:06 PM, said:

EDIT3: Speaking of Bryan, he wanted me to relay his apologies to everyone on the forums and that he's changed since. He'd like to join on the discussion.

I was also contacted by Bryan's brother. In the past, Bryan has claimed to be sorry, and then gone right back to his old ways, so I don't think we'll allow him back here just because he's apologizing. Maybe he can demonstrate good behavior somewhere else first, and we'll take a look.

[High Treason]

950908 - Isn't this the one with the dongle protection? Because I think there are worse problems than that;

 20170525063216.JPG (208.92K)
Number of downloads: 120

I am guessing that the file was not found at all when searching?

Of course, the resources can still be explored without running the game, so there's still plenty of stuff to do with it.

[LeoTCK]

If anywhere the crossbow is really working it would be that particular version...

Either way on topic of Bryan, you realize he's older and more experienced now and doesn't easily get angered as much anymore. I personally haven't seen any conflict involving him in the last year or so.

So I could vouch for that. It's unlikely to happen, very very unlikely.

[Hendricks266]

High Treason, on 24 May 2017 - 09:36 PM, said:

950908 - Isn't this the one with the dongle protection? Because I think there are worse problems than that;

20170525063216.JPG

I am guessing that the file was not found at all when searching?

Of course, the resources can still be explored without running the game, so there's still plenty of stuff to do with it.

That's the dongle. The message is a lie. When encrypting an exe, you got to configure it to say whatever error message you wanted. With the message they chose, someone who tried to run a leaked copy wouldn't know it was encrypted, and they would think it was broken for other reasons. I have evidence of other messages being used, such as claiming to erase all your files.

[High Treason]

I did consider something along those lines and thought more that it might be falling back into some other branch when the protection failed to find what it was looking for. But yeah, I see the point of that and find the idea of some 90s pirate getting all excited about leaking the latest FPS only to then spend all day trying to figure out where this file has gone or else having a heart attack because he thinks files are being erased. I did investigate the EXE briefly, but only looking for strings of text and I did see some other error messages.

The _NOTE.TXT includes no mention of the error message, only that there is a copy protection and that another EXE was included. That or EDIT doesn't like the text file for some reason.


Ironically it might fall on pirates to fix it. Who knows, some bored cracker might randomly decide to investigate it at some stage.

[Hendricks266]

The betas.bat does include a full explanation.

[High Treason]

Ah, I see. I've not used that and didn't copy it over with the directories to the K5.

[Hendricks266]

Hey HT... do you have anything capable of recording the signals sent to a parallel port?

If the protocol is simple enough, I could probably write a TSR that could intercept the calls and fool the exe into thinking the dongle is present.

[High Treason]

I was actually just pondering if it was possible to intercept anything from the port as it's not too far fetched to assume something might happen there to wake the dongle up.

At the moment I don't have anything to look at what the port is doing, but I think there were parallel LapLink cables (I have only Serial versions to hand) and I don't mind ordering one if you want me to give this a shot. From there it should theoretically be trivial to read anything that comes out of the port.

Alternatively, it may be possible to build a loopback device and try reading from it on the same system. I'm not sure how I'd go about reading the data in DOS or if Windows would give up control of the port to the DOS-on-Windows session. If I can find, or if you can provide, a utility which will log data from the parallel port I will definitely give this a try and I shall experiment in the meantime.

Edit: I can at least confirm that there is activity on the parallel port when the EXE is started. It appears to scan every parallel port;

Quote

IO:Read from port 0378
IO:Writing 80 to port 0378
IO:Read from port 0379
IO:Read from port 03BC
IO:Writing 80 to port 03BC
IO:Read from port 03BD
IO:Read from port 0278
IO:Writing 80 to port 0278
IO:Read from port 0279

[Hendricks266]

If it's possible for a TSR to intercept parallel port traffic, then it must be possible for it to sniff it. I'm not sure if the former is true, unfortunately. I'm rusty on it, since it's been 3 years since I modified Lee Killough's FAKEDATE.COM from the Doom press release beta to accept arbitrary dates, which would provide a solution for other Apogee betas that worked on real hardware.

http://hendricks266....ff/fakedate2.7z

[NY00123]

From the little I know, TSRs can be used to take over interrupts. Dunno about I/O port reads and writes.

But these days, maybe a DOS emulator (like DOSBox) can be modified to "transmit" specific I/O data on each parallel port read, say from a "password" file.
I dunno how easy or difficult it'll be to figure it out. In the worst case, you've gotten the brute-force approach with multiple runs of the modified emulator.

Note that it might be better to run it in a (somewhat) sandboxed environment, just in case it can trash a large section of your hard drive... heh.



For a related analogy, know how some pieces of software have anti-debugger detection mechanisms (which might also be present in these protected EXEs, btw)? Well, I guess it's way more difficult for them to detect the debugger in these DOSBox debugger builds...

[icecoldduke]

NY00123, on 25 May 2017 - 08:00 AM, said:

For a related analogy, know how some pieces of software have anti-debugger detection mechanisms (which might also be present in these protected EXEs, btw)? Well, I guess it's way more difficult for them to detect the debugger in these DOSBox debugger builds...

Anti debugger tech now a days basically works like this. You have your main app and your proxy app. Your proxy app debug attaches to your main app. Then your main app debug attaches to your proxy app. You have critical logic stored in the proxy app and communication between the proxy and the main app happen through exceptions. I can't imagine anything of this sophistication that would have existed back in the dos days, so if anti debugger tech is present, I can't imagine it being very robust.

[Mark]

I know this is a shot in the dark from a noob but, if the dongle was a simple shorting of pins together or through diodes, once you discount all the grounded pins and the important pins for a printer that narrows down the pins that could have been used for the dongle feature. Maybe few enough that trial end error could find the proper pins. But if there was any kind of electronics in the dongle then I have no ideas.

[High Treason]

There were always sophisticated solutions, but they were expensive and not widely used.

As it stands currently, I've had almost no luck aside from a modified DOSBox build which lets me look at the PIC. This tells me nothing beyond what we already know - that the EXE does something to the parallel port - and nothing more.
 TEST - Copy.LOG (22.75K)
Number of downloads: 11


I am not sure if the build works properly outside of Linux though due to how the documentation is worded and I haven't had success compiling it in Lubuntu - it fails in CPU.CPP quite quickly, I'm rusty as hell at this and I'm not a Linux guy anyway.
ftp://elanda.kiev.ua...ta/pppatch.html
I'll included the DOSBox build and it's source in case anyone else wants to play with it. The site it is from is dead, but if you want to compile the source I believe it uses the same libraries as SVN-Daum which kindly lists them on the "DOSBox SVN Builds" page.
 DMB6.zip (4.52MB)
Number of downloads: 6

The SVN Daum version doesn't appear to support parallel debugging, which is why I was trying the outdated Megabuild 6. I used to be on a forum that the author was on, but I've long since been banned for behaving like it was Duke4.net over there.

I do have a parallel InterLink cable coming though, so I may be able to hook that up to a Linux box and try reading from /dev/lp0 to nab anything that comes down the line. It has thus far proven elusive running on real systems, PortMon can't catch it on the way out and no amount of port rerouting can snag it using what cables I have - it seems as though no data is sent or else the system at the other end doesn't pay it any attention for whatever reason, so I assume my port rerouting either doesn't work or else is detected by the copy protection. Interestingly it also appears that the EXE doesn't always attempt to access parallel ports if run more than once... Not sure on that one.

Anyway, I'll keep dicking around with it in my spare time.

Not too worried about using my real hard drive, there's nothing important on there and they're all imaged after Windows installs are complete anyway. If it somehow broke something in a fit of rage at being tampered with, I'd just have to Ghost the image back on which takes about 20 minutes tops - these are all SCSI machines, except the K6.

Edit: One last note - judging to the addresses it accesses, the copy protection expects an ECP capable port. I'm not sure of what this might imply, such ports could complicate things as they have DMA and also imply there could be some kind of compression making it harder to look into what is going on.

[Svanis]

The Debug counter in the 1995 build is just the player's health. In the June 11 1996 proto, you can puke by holding the fire key when dead. I have a bug in the June '96 protos where the weapon sprites don't show, it worked only once. Does anyone know of a fix for this?