-
-
Notifications
You must be signed in to change notification settings - Fork 999
/
script_patches.cpp
15328 lines (14407 loc) · 697 KB
/
script_patches.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/* ScummVM - Graphic Adventure Engine
*
* ScummVM is the legal property of its developers, whose names
* are too numerous to list here. Please refer to the COPYRIGHT
* file distributed with this source distribution.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
*
*/
#include "sci/sci.h"
#include "sci/engine/kernel.h"
#include "sci/engine/script.h"
#include "sci/engine/state.h"
#include "sci/engine/features.h"
#include "sci/engine/script_patches.h"
#ifdef ENABLE_SCI32
#include "sci/engine/guest_additions.h"
#endif
#include "common/util.h"
namespace Sci {
// IMPORTANT:
// every patch entry needs the following:
// - script number (pretty obvious)
//
// - apply count
// specifies the number of times a patch is supposed to get applied.
// Most of the time, it should be 1.
//
// - magicDWORD + magicOffset
// please ALWAYS put 0 for those two. Both will get filled out at runtime by the patcher.
//
// - signature data (is used to identify certain script code, that needs patching)
// every signature needs to contain SIG_MAGICDWORD once.
// The following 4 bytes after SIG_MAGICDWORD - which don't have to be fixed, you may for example
// use SIG_SELECTOR16, will get used to quickly search for a partly match before verifying that
// the whole signature actually matches. If it's not included, the script patcher will error() out
// right when loading up the game.
// If selector-IDs are included, please use SIG_SELECTOR16 + SIG_SELECTOR8 [1]. Simply
// specify the selector that way, so that the patcher will search for the specific
// selector instead of looking for a hardcoded value. Selectors may not be the same
// between game versions.
// For UINT16s either use SIG_UINT16 or SIG_SELECTOR16.
// Macintosh versions of SCI games are using BE ordering instead of LE since SCI1.1 for UINT16s in scripts
// By using those 2 commands, it's possible to make patches work for PC and Mac versions of the same game.
// You may also skip bytes by using the SIG_ADDTOOFFSET command
// Every signature data needs to get terminated using SIGNATURE_END
//
// - patch data (is used for actually patching scripts)
// When a match is found, the patch data will get applied.
// Patch data is similar to signature data. Just use PATCH_SELECTOR16 + PATCH_SELECTOR8 [1]
// for patching in selectors.
// There are also patch specific commands.
// Those are PATCH_GETORIGINALBYTE, which fetches a byte from the original script
// and PATCH_GETORIGINALBYTEADJUST, which does the same but gets a second value
// from the uint16 array and uses that value to adjust the original byte.
// Every patch data needs to get terminated using PATCH_END
//
// - and please always add a comment about why the patch was done and what's causing issues.
// If possible make sure, that the patch works on localized (or just different) game versions
// as well in case those need patching too.
//
// [1] - selectors need to get specified in selectorTable[] and ScriptPatcherSelectors-enum
// before they can get used using the SIG_SELECTORx and PATCH_SELECTORx commands.
// You have to use the exact same order in both the table and the enum, otherwise
// it won't work.
// ATTENTION: selectors will only work here, when they are also in SelectorCache (selector.h)
static const char *const selectorNameTable[] = {
"cycles", // system selector
"seconds", // system selector
"init", // system selector
"dispose", // system selector
"new", // system selector
"curEvent", // system selector
"disable", // system selector
"doit", // system selector
"show", // system selector
"x", // system selector
"cel", // system selector
"setMotion", // system selector
"overlay", // system selector
"setPri", // system selector - for setting priority
"play", // system selector
"number", // system selector
"setScript", // system selector
"setCycle", // system selector
"setStep", // system selector
"cycleSpeed", // system selector
"handsOff", // system selector
"handsOn", // system selector
"localize", // Freddy Pharkas
"roomFlags", // Iceman
"put", // Police Quest 1 VGA
"changeState", // Quest For Glory 1 VGA, QFG4
"hide", // Quest For Glory 1 VGA, QFG4
"say", // Quest For Glory 1 VGA, QFG4
"script", // Quest For Glory 1 VGA
"solvePuzzle", // Quest For Glory 3
"timesShownID", // Space Quest 1 VGA
"startText", // King's Quest 6 CD / Laura Bow 2 CD for audio+text support
"startAudio", // King's Quest 6 CD / Laura Bow 2 CD for audio+text support
"modNum", // King's Quest 6 CD / Laura Bow 2 CD for audio+text support
"has", // King's Quest 6, GK1
"modeless", // King's Quest 6 CD
"cycler", // Space Quest 4 / system selector
"setCel", // Space Quest 4, Phant2, GK1
"addToPic", // Space Quest 4
"stop", // Space Quest 4
"canControl", // Space Quest 4
"looper", // Space Quest 4
"nMsgType", // Space Quest 4
"doVerb", // Space Quest 4
"setRegions", // Space Quest 4
"loop", // Laura Bow 1 Colonel's Bequest, QFG4
"setLoop", // Laura Bow 1 Colonel's Bequest, QFG4
"ignoreActors", // Laura Bow 1 Colonel's Bequest
"setVol", // Laura Bow 2 CD
"at", // Longbow, QFG4
"owner", // Longbow, QFG4
"delete", // EcoQuest 1
"size", // EcoQuest 1
"signal", // EcoQuest 1, GK1
"obstacles", // EcoQuest 1, QFG4
#ifdef ENABLE_SCI32
"newWith", // SCI2 array script
"scrollSelections", // GK2
"posn", // SCI2 benchmarking script
"detailLevel", // GK2 benchmarking
"view", // RAMA benchmarking, GK1, QFG4
"fade", // Shivers
"handleEvent", // Shivers
"test", // Torin
"get", // Torin, GK1
"newRoom", // GK1
"normalize", // GK1
"set", // Torin
"clear", // Torin
"masterVolume", // SCI2 master volume reset
"data", // Phant2, QFG4
"format", // Phant2
"setSize", // Phant2
"iconV", // Phant2
"update", // Phant2
"xOff", // Phant2
"fore", // KQ7
"back", // KQ7
"font", // KQ7
"setScale", // LSL6hires, QFG4
"setScaler", // LSL6hires, QFG4
"readWord", // LSL7, Phant1, Torin
"points", // PQ4
"select", // PQ4
"addObstacle", // QFG4
"handle", // RAMA
"saveFilePtr", // RAMA
"priority", // RAMA
"plane", // RAMA
"state", // RAMA
"getSubscriberObj", // RAMA
"advanceCurIcon", // QFG4
"amount", // QFG4
"approachVerbs", // QFG4
"cue", // QFG4
"curIcon", // QFG4
"curInvIcon", // QFG4
"getCursor", // QFG4
"heading", // QFG4
"moveSpeed", // QFG4
"sayMessage", // QFG4
"setCursor", // QFG4
"setLooper", // QFG4
"setSpeed", // QFG4
"useStamina", // QFG4
"value", // QFG4
#endif
NULL
};
enum ScriptPatcherSelectors {
SELECTOR_cycles = 0,
SELECTOR_seconds,
SELECTOR_init,
SELECTOR_dispose,
SELECTOR_new,
SELECTOR_curEvent,
SELECTOR_disable,
SELECTOR_doit,
SELECTOR_show,
SELECTOR_x,
SELECTOR_cel,
SELECTOR_setMotion,
SELECTOR_overlay,
SELECTOR_setPri,
SELECTOR_play,
SELECTOR_number,
SELECTOR_setScript,
SELECTOR_setCycle,
SELECTOR_setStep,
SELECTOR_cycleSpeed,
SELECTOR_handsOff,
SELECTOR_handsOn,
SELECTOR_localize,
SELECTOR_roomFlags,
SELECTOR_put,
SELECTOR_changeState,
SELECTOR_hide,
SELECTOR_say,
SELECTOR_script,
SELECTOR_solvePuzzle,
SELECTOR_timesShownID,
SELECTOR_startText,
SELECTOR_startAudio,
SELECTOR_modNum,
SELECTOR_has,
SELECTOR_modeless,
SELECTOR_cycler,
SELECTOR_setCel,
SELECTOR_addToPic,
SELECTOR_stop,
SELECTOR_canControl,
SELECTOR_looper,
SELECTOR_nMsgType,
SELECTOR_doVerb,
SELECTOR_setRegions,
SELECTOR_loop,
SELECTOR_setLoop,
SELECTOR_ignoreActors,
SELECTOR_setVol,
SELECTOR_at,
SELECTOR_owner,
SELECTOR_delete,
SELECTOR_size,
SELECTOR_signal,
SELECTOR_obstacles
#ifdef ENABLE_SCI32
,
SELECTOR_newWith,
SELECTOR_scrollSelections,
SELECTOR_posn,
SELECTOR_detailLevel,
SELECTOR_view,
SELECTOR_fade,
SELECTOR_handleEvent,
SELECTOR_test,
SELECTOR_get,
SELECTOR_newRoom,
SELECTOR_normalize,
SELECTOR_set,
SELECTOR_clear,
SELECTOR_masterVolume,
SELECTOR_data,
SELECTOR_format,
SELECTOR_setSize,
SELECTOR_iconV,
SELECTOR_update,
SELECTOR_xOff,
SELECTOR_fore,
SELECTOR_back,
SELECTOR_font,
SELECTOR_setScale,
SELECTOR_setScaler,
SELECTOR_readWord,
SELECTOR_points,
SELECTOR_select,
SELECTOR_addObstacle,
SELECTOR_handle,
SELECTOR_saveFilePtr,
SELECTOR_priority,
SELECTOR_plane,
SELECTOR_state,
SELECTOR_getSubscriberObj,
SELECTOR_advanceCurIcon,
SELECTOR_amount,
SELECTOR_approachVerbs,
SELECTOR_cue,
SELECTOR_curIcon,
SELECTOR_curInvIcon,
SELECTOR_getCursor,
SELECTOR_heading,
SELECTOR_moveSpeed,
SELECTOR_sayMessage,
SELECTOR_setCursor,
SELECTOR_setLooper,
SELECTOR_setSpeed,
SELECTOR_useStamina,
SELECTOR_value
#endif
};
#ifdef ENABLE_SCI32
// It is not possible to change the directory for ScummVM save games, so disable
// the "change directory" button in the standard save dialogue
static const uint16 sci2ChangeDirSignature[] = {
0x72, SIG_ADDTOOFFSET(+2), // lofsa changeDirI
0x4a, SIG_UINT16(0x0004), // send 4
SIG_MAGICDWORD,
0x36, // push
0x35, 0xf7, // ldi $f7
0x12, // and
0x36, // push
SIG_END
};
static const uint16 sci2ChangeDirPatch[] = {
PATCH_ADDTOOFFSET(+3), // lofsa changeDirI
PATCH_ADDTOOFFSET(+3), // send 4
PATCH_ADDTOOFFSET(+1), // push
0x35, 0x00, // ldi 0
PATCH_END
};
// Save game script hardcodes the maximum number of save games to 20, but
// this is an artificial constraint that does not apply to ScummVM
static const uint16 sci2NumSavesSignature1[] = {
SIG_MAGICDWORD,
0x8b, 0x02, // lsl local[2]
0x35, 0x14, // ldi 20
0x22, // lt?
SIG_END
};
static const uint16 sci2NumSavesPatch1[] = {
PATCH_ADDTOOFFSET(+2), // lsl local[2]
0x35, 0x63, // ldi 99
PATCH_END
};
static const uint16 sci2NumSavesSignature2[] = {
SIG_MAGICDWORD,
0x8b, 0x02, // lsl local[2]
0x35, 0x14, // ldi 20
0x1a, // eq?
SIG_END
};
static const uint16 sci2NumSavesPatch2[] = {
PATCH_ADDTOOFFSET(+2), // lsl local[2]
0x35, 0x63, // ldi 99
PATCH_END
};
// Phantasmagoria & SQ6 try to initialize the first entry of an int16 array
// using an empty string, which is not valid (it should be a number)
static const uint16 sci21IntArraySignature[] = {
0x38, SIG_SELECTOR16(newWith), // pushi newWith
0x7a, // push2
0x39, 0x04, // pushi $4
0x72, SIG_ADDTOOFFSET(+2), // lofsa string ""
SIG_MAGICDWORD,
0x36, // push
0x51, 0x0b, // class IntArray
0x4a, 0x08, // send $8
SIG_END
};
static const uint16 sci21IntArrayPatch[] = {
PATCH_ADDTOOFFSET(+6), // push $b9; push2; pushi $4
0x76, // push0
0x34, PATCH_UINT16(0x0001), // ldi 0001 (waste bytes)
PATCH_END
};
// Most SCI32 games have a video performance benchmarking loop at the
// beginning of the game. Running this benchmark with calls to
// `OSystem::updateScreen` will often cause the benchmark to return a low value,
// which causes games to disable some visual effects. Running without calls to
// `OSystem::updateScreen` on any reasonably modern CPU will cause the benchmark
// to overflow, leading to randomly disabled effects. This patch changes the
// benchmarking code to always return the game's maximum speed value.
//
// Applies to at least: GK1 floppy, PQ4 floppy, PQ4CD, LSL6hires, Phant1,
// Shivers, SQ6
static const uint16 sci2BenchmarkSignature[] = {
SIG_MAGICDWORD,
0x38, SIG_SELECTOR16(init), // pushi init
0x76, // push0
0x38, SIG_SELECTOR16(posn), // pushi posn
SIG_END
};
static const uint16 sci2BenchmarkPatch[] = {
0x7a, // push2
0x38, SIG_UINT16(64908), // pushi 64908
0x76, // push0
0x43, 0x03, SIG_UINT16(0x04), // callk DisposeScript[3], 4
0x48, // ret
PATCH_END
};
// The init code that runs in many SCI32 games unconditionally resets the music
// volume, but the game should always use the volume stored in ScummVM.
// Applies to at least: LSL6hires, MGDX, PQ:SWAT, QFG4
static const uint16 sci2VolumeResetSignature[] = {
SIG_MAGICDWORD,
0x38, SIG_SELECTOR16(masterVolume), // pushi masterVolume
0x78, // push1
0x39, SIG_ADDTOOFFSET(+1), // pushi [default volume]
0x81, 0x01, // lag global[1]
0x4a, SIG_UINT16(0x0006), // send 6
SIG_END
};
static const uint16 sci2VolumeResetPatch[] = {
0x32, PATCH_UINT16(0x0008), // jmp 8 [past volume reset]
PATCH_END
};
// At least Gabriel Knight 1 and Police Quest 4 floppy have a broken Str::strip inside script 64918.
// The code never passes over the actual string to kStringTrim, so that would not work and also trigger
// a signature mismatch.
// Localized version of Police Quest 4 were also affected.
// Gabriel Knight although affected doesn't seem to ever call the code, so there is no reason to patch it.
// Police Quest 4 CD got this fixed.
static const uint16 sci2BrokenStrStripSignature[] = {
SIG_MAGICDWORD,
0x85, 0x06, // lat temp[6]
0x31, 0x10, // bnt [jump to code that passes 2 parameters]
0x38, SIG_UINT16(0x00c2), // pushi 00c2 (callKernel)
0x38, SIG_UINT16(0x0003), // pushi 03
0x39, 0x0e, // pushi 0e
0x8d, 0x0b, // lst temp[0b]
0x36, // push
0x54, SIG_UINT16(0x000a), // self 0a
0x33, 0x0b, // jmp [ret]
// 2 parameter code
0x38, SIG_UINT16(0x00c2), // pushi 00c2
0x7a, // push2
0x39, 0x0e, // pushi 0e
0x8d, 0x0b, // lst temp[0b]
0x54, SIG_UINT16(0x0008), // self 08
SIG_END
};
static const uint16 sci2BrokenStrStripPatch[] = {
PATCH_ADDTOOFFSET(+2),
0x85, 0x06, // lat temp[6] (once more]
PATCH_ADDTOOFFSET(+3), // jump over pushi callKernel
0x39, 0x04, // pushi 04
0x39, 0x0e, // pushi 0e
// Attention: data is 0x14 in PQ4 CD, in floppy it's 0x12
0x67, 0x12, // pTos data (pass actual data)
0x8d, 0x0b, // lst temp[0b]
0x36, // push
0x54, PATCH_UINT16(0x000c), // self 0c
0x48, // ret
PATCH_END
};
// Torin/LSL7-specific version of sci2NumSavesSignature1/2
// Applies to at least: English CD
static const uint16 torinLarry7NumSavesSignature[] = {
SIG_MAGICDWORD,
0x36, // push
0x35, 0x14, // ldi 20
0x20, // ge?
SIG_END
};
static const uint16 torinLarry7NumSavesPatch[] = {
PATCH_ADDTOOFFSET(+1), // push
0x35, 0x63, // ldi 99
PATCH_END
};
#endif
// ===========================================================================
// Conquests of Camelot
// At the bazaar in Jerusalem, it's possible to see a girl taking a shower.
// If you get too close, you get warned by the father - if you don't get away,
// he will kill you.
// Instead of walking there manually, it's also possible to enter "look window"
// and ego will automatically walk to the window. It seems that this is something
// that wasn't properly implemented, because instead of getting killed, you will
// get an "Oops" message in Sierra SCI.
//
// This is caused by peepingTom in script 169 not getting properly initialized.
// peepingTom calls the object behind global[b9h]. This global variable is
// properly initialized when walking there manually (method fawaz::doit).
// When you instead walk there automatically (method fawaz::handleEvent), that
// global isn't initialized, which then results in the Oops-message in Sierra SCI
// and an error message in ScummVM/SCI.
//
// We fix the script by patching in a jump to the proper code inside fawaz::doit.
// Responsible method: fawaz::handleEvent
// Fixes bug: #6402
static const uint16 camelotSignaturePeepingTom[] = {
0x72, SIG_MAGICDWORD, SIG_UINT16(0x077e), // lofsa fawaz <-- start of proper initializion code
0xa1, 0xb9, // sag global[b9h]
SIG_ADDTOOFFSET(+571), // ...
0x39, 0x7a, // pushi 7a <-- initialization code when walking automatically
0x78, // push1
0x7a, // push2
0x38, SIG_UINT16(0x00a9), // pushi 00a9 - script 169
0x78, // push1
0x43, 0x02, 0x04, // callk ScriptID
0x36, // push
0x81, 0x00, // lag global[0]
0x4a, 0x06, // send 06
0x32, SIG_UINT16(0x0520), // jmp [end of fawaz::handleEvent]
SIG_END
};
static const uint16 camelotPatchPeepingTom[] = {
PATCH_ADDTOOFFSET(+576),
0x32, PATCH_UINT16(0xfdbd), // jmp [to fawaz::doit] (properly init peepingTom code)
PATCH_END
};
// script, description, signature patch
static const SciScriptPatcherEntry camelotSignatures[] = {
{ true, 62, "fix peepingTom Sierra bug", 1, camelotSignaturePeepingTom, camelotPatchPeepingTom },
SCI_SIGNATUREENTRY_TERMINATOR
};
// ===========================================================================
// stayAndHelp::changeState (0) is called when ego swims to the left or right
// boundaries of room 660. Normally a textbox is supposed to get on screen
// but the call is wrong, so not only do we get an error message the script
// is also hanging because the cue won't get sent out
// This also happens in sierra sci
// Applies to at least: PC-CD
// Responsible method: stayAndHelp::changeState
// Fixes bug: #5107
static const uint16 ecoquest1SignatureStayAndHelp[] = {
0x3f, 0x01, // link 01
0x87, 0x01, // lap param[1]
0x65, 0x14, // aTop state
0x36, // push
0x3c, // dup
0x35, 0x00, // ldi 00
0x1a, // eq?
0x31, 0x1c, // bnt [next state]
0x76, // push0
0x45, 0x01, 0x00, // callb [export 1 of script 0], 00 (switching control off)
SIG_MAGICDWORD,
0x38, SIG_UINT16(0x0122), // pushi 0122
0x78, // push1
0x76, // push0
0x81, 0x00, // lag global[0]
0x4a, 0x06, // send 06 - call ego::setMotion(0)
0x39, SIG_SELECTOR8(init), // pushi init
0x39, 0x04, // pushi 04
0x76, // push0
0x76, // push0
0x39, 0x17, // pushi 17
0x7c, // pushSelf
0x51, 0x82, // class EcoNarrator
0x4a, 0x0c, // send 0c - call EcoNarrator::init(0, 0, 23, self) (BADLY BROKEN!)
0x33, // jmp [end]
SIG_END
};
static const uint16 ecoquest1PatchStayAndHelp[] = {
0x87, 0x01, // lap param[1]
0x65, 0x14, // aTop state
0x36, // push
0x2f, 0x22, // bt [next state] (this optimization saves 6 bytes)
0x39, 0x00, // pushi 0 (wasting 1 byte here)
0x45, 0x01, 0x00, // callb [export 1 of script 0], 00 (switching control off)
0x38, PATCH_UINT16(0x0122), // pushi 0122
0x78, // push1
0x76, // push0
0x81, 0x00, // lag global[0]
0x4a, 0x06, // send 06 - call ego::setMotion(0)
0x39, PATCH_SELECTOR8(init), // pushi init
0x39, 0x06, // pushi 06
0x39, 0x02, // pushi 02 (additional 2 bytes)
0x76, // push0
0x76, // push0
0x39, 0x17, // pushi 17
0x7c, // pushSelf
0x38, PATCH_UINT16(0x0280), // pushi 280 (additional 3 bytes)
0x51, 0x82, // class EcoNarrator
0x4a, 0x10, // send 10 - call EcoNarrator::init(2, 0, 0, 23, self, 640)
PATCH_END
};
// Giving the oily shell to Superfluous when he's out of the mask runs the
// wrong animation and skips messages in the CD version. Sierra modified
// getInOilyShell for the CD version by adding a new state to the beginning
// but forgot to increment the state numbers passed to self:changeState to
// their new values, causing the script to change to the wrong states.
//
// We fix this by incrementing the state numbers passed to self:changeState.
//
// Applies to: PC CD
// Responsible method: getInOilyShell:changeState
// Fixes bug #10881
static const uint16 ecoquest1SignatureGiveOilyShell[] = {
0x30, SIG_UINT16(0x000a), // bnt 000a
0x38, SIG_UINT16(0x0090), // pushi changeState [ hard coded for CD ]
0x78, // push1
0x7a, // push2 [ state 2 ]
0x54, SIG_MAGICDWORD, 0x06, // self 06
0x32, SIG_UINT16(0x0195), // jmp 0195
SIG_ADDTOOFFSET(+209),
0x39, 0x08, // pushi 08 [ state 8 ]
SIG_ADDTOOFFSET(+16),
0x39, 0x0b, // pushi 0b [ state 11 ]
SIG_END
};
static const uint16 ecoquest1PatchGiveOilyShell[] = {
0x31, 0x0b, // bnt 0b
0x38, PATCH_UINT16(0x0090), // pushi changeState [ hard coded for CD ]
0x78, // push1
0x39, 0x03, // pushi 03 [ state 3 ]
PATCH_ADDTOOFFSET(+214),
0x39, 0x09, // pushi 09 [ state 9 ]
PATCH_ADDTOOFFSET(+16),
0x39, 0x0c, // pushi 0c [ state 12 ]
PATCH_END
};
// Reading the prophecy scroll in the CD version breaks messages in at least
// rooms 100 and 120. scrollScript:init overwrites the global that holds the
// noun for the room's message tuples. This global was added in the CD version
// and is set by most rooms during initialization. This pattern was mistakenly
// applied to scrollScript which isn't a room and doesn't depend on the global.
//
// We fix this by skipping the problematic code which overwrites the global.
//
// Applies to: PC CD
// Responsible method: scrollScript:init
// Fixes bug #10883
static const uint16 ecoquest1SignatureProphecyScroll[] = {
SIG_MAGICDWORD,
0x35, 0x01, // ldi 01
0xa1, 0xfa, // sag fa [ global250 = 1 ]
SIG_END
};
static const uint16 ecoquest1PatchProphecyScroll[] = {
0x33, 0x02, // jmp 02 [ don't set global250 ]
PATCH_END
};
// The empty apartments have several broken messages in the CD version due to
// not setting the global that holds the current room's noun, so we set it.
//
// Applies to: PC CD
// Responsible method: rm220:init
// Fixes bug #10903
static const uint16 ecoquest1SignatureEmptyApartmentMessages[] = {
SIG_MAGICDWORD,
0x54, 0x0c, // self 0c [ self setRegions: 51, addObstacle: ... ]
0x39, SIG_SELECTOR8(init), // pushi init
0x76, // push0
0x59, 0x01, // &rest 01 [ unused by ApartmentRoom:init ]
0x57, 0x96, 0x04, // super ApartmentRoom 04 [ super init: &rest ]
SIG_END
};
static const uint16 ecoquest1PatchEmptyApartmentMessages[] = {
0x35, 0x01, // ldi 01 [ the room's noun ]
PATCH_ADDTOOFFSET(+3),
0xa1, 0xfa, // sag fa [ global250 = 1 ]
0x57, 0x96, 0x10, // super ApartmentRoom 10 [ combine self and super ]
PATCH_END
};
// The temple has a complex script bug in the CD version which can crash the
// interpreter when solving the mosaic puzzle after loading a game that was
// saved during the puzzle. The bug causes invalid memory access which locks up
// Sierra's interpreter and can cause ours to fail an assertion.
//
// Room 140 has three insets and a conch shell in the middle. This room's script
// was significantly changed in the CD version and transition animations were
// added. Due to these changes the shell no longer renders beneath the insets
// and so Sierra added code to hide the shell while they're displayed.
// Unfortunately this code is incorrect and leaves the game in a state that's
// unsafe to save. The shell is removed from the cast when showing an inset and
// then shell:init is called when hiding. This leaves shell:underBits pointing
// to hunk memory while temporarily not a member of the cast. Hunk memory isn't
// persisted in saved games but underBits' values are. SCI games handle this in
// Game:replay by clearing the underBits of cast members when restoring. Saving
// while the puzzle is displayed causes shell:underBits' stale hunk value to
// survive restoring. Solving the puzzle adds the shell back to the cast via
// init followed by a call to kAnimate that accesses the potentially stale
// shell:underBits. If the hunk segment id upon restoring in ScummVM is the
// same as when saved then this out of bounds access will fail an assertion.
//
// We fix this by fully disposing the shell when showing an inset so that its
// resources are cleaned up and it's safe to save the game. In order to do this
// without changing the animation effect we set shell's disposal flag and then
// immediately call shell:delete. This is equivalent to shell:dispose but
// prevents hiding the shell before the transition animation takes place.
//
// Applies to: PC CD
// Responsible methods: MosaicWall:doVerb, localproc_2ab6 in script 140
// Fixes bug #10884
static const uint16 ecoquest1SignatureMosaicPuzzleFix[] = {
0x36, // push [ conchShell:owner ]
0x34, SIG_UINT16(0x008c), // ldi 008c [ room number ]
0x1a, // eq? [ is conchShell owned by room 140? ]
0x30, SIG_UINT16(0x000b), // bnt 000b [ no shell to hide ]
SIG_MAGICDWORD,
0x39, SIG_SELECTOR8(delete), // pushi delete
0x78, // push1
0x72, SIG_UINT16(0x056a), // lofsa shell
0x36, // push
0x81, 0x05, // lag 05
0x4a, 0x06, // send 06 [ cast delete: shell ]
SIG_END
};
static const uint16 ecoquest1PatchMosaicPuzzleFix[] = {
0x89, 0x0b, // lsg 0b [ current room number, saves 2 bytes ]
0x1a, // eq? [ is conchShell owned by room 140? ]
0x31, 0x0e, // bnt 0e [ no shell to hide, save a byte ]
0x39, PATCH_SELECTOR8(signal), // pushi signal
0x78, // push1
0x38, PATCH_UINT16(0xc014), // pushi c014 [ kSignalDisposeMe | shell:signal ]
0x39, PATCH_SELECTOR8(delete), // pushi delete
0x76, // push0
0x72, PATCH_UINT16(0x056a), // lofsa shell
0x4a, 0x0a, // send 0a [ shell signal: c014, delete ]
PATCH_END
};
// The column puzzle in room 160 can be put in a state that can't be completed.
// This is a bug in the original that affects all versions.
//
// The puzzle consists of nine columns that must be rotated to their correct
// positions in the correct order. As each column is solved it is locked. When
// leaving the room the puzzle state is saved to globals but this state is
// insufficient to recreate the puzzle. The game saves column positions but not
// lock states. Instead it infers lock states from positions when restoring but
// this is inaccurate because columns can be put in their correct positions out
// of order. If the player leaves the room while all columns are in their
// correct positions but before the puzzle is solved then all columns will be
// locked when returning and the game can't be completed.
//
// The proper solution would be to save and restore lock states but it would be
// impractical to patch in that functionality while retaining save game
// compatibility. Instead we patch the loop that reinitializes lock states to
// skip the last column so that it's always unlocked and the player can't get
// stuck. This code only runs when the puzzle isn't solved and should never
// have been able to lock the last column.
//
// Applies to: All Floppy and CD versions
// Responsible method: Local procedure 5 in script 160
// Fixes bug #10885
static const uint16 ecoquest1SignatureColumnPuzzleFix[] = {
0x39, SIG_SELECTOR8(size), // pushi size
0x76, // push0
0x72, SIG_ADDTOOFFSET(+2), // lofsa columnList [ columns in solution order ]
0x4a, 0x04, // send 04 [ columnList:size ]
0x22, // lt? [ temp0 < columnList:size (9) ]
0x30, SIG_ADDTOOFFSET(+2), // bnt [ end of method ]
0x39, SIG_MAGICDWORD, // pushi cel
SIG_SELECTOR8(cel),
0x76, // push0
0x39, SIG_SELECTOR8(at), // pushi at
SIG_END
};
static const uint16 ecoquest1PatchColumnPuzzleFix[] = {
0x34, PATCH_UINT16(0x0008), // ldi 0008 [ only initialize 8 of 9 columns ]
0x32, PATCH_UINT16(0x0002), // jmp 0002
PATCH_END
};
// The ocean cliffs that border rooms 320 and 321 aren't displayed in the CD
// version. Instead they are drawn above the visible area and on more screens
// than they should. This also occurs in the original.
//
// Cliff views 325 and 326 have y displacements greater than 127 in the floppy
// versions. In the CD version these offsets were changed to zero. Sierra
// attempted to compensate for this by adding rows of empty pixels to the views
// but it appears that someone mistook the unsigned offsets for negative values
// and added the wrong number of rows to the wrong side of the views, causing
// the cliffs to be drawn 256 pixels higher than normal.
//
// The ocean scripts were changed to use different techniques for adding and
// removing the cliffs but this introduced more errors. Room 321 reinitializes
// the cliffs instead of disposing them, causing them to be redrawn on the
// wrong screens, and room 320 disposes the eastern cliffs instead of western.
//
// We fix the cliffs by adjusting their positions by 256 and disposing of them
// in room 321. We leave room 320's incorrect cliff disposal in place since
// both are automatically disposed of when that room's pic changes.
//
// Applies to: PC CD
// Responsible methods: Heap in scripts 320 and 321, toEast:changeState, toWest:changeState
// Fixes bug #10893
static const uint16 ecoquest1SignatureSouthCliffsPosition[] = {
SIG_MAGICDWORD,
SIG_UINT16(0x0095), // easternCliffs:x = 149
SIG_UINT16(0x0033), // easternCliffs:y = 51
SIG_ADDTOOFFSET(+88),
SIG_UINT16(0x0004), // westernCliffs:x = 4
SIG_UINT16(0x0014), // westernCliffs:y = 20
SIG_END
};
static const uint16 ecoquest1PatchSouthCliffsPosition[] = {
PATCH_ADDTOOFFSET(+2),
PATCH_UINT16(0x0133), // easternCliffs:y = 307
PATCH_ADDTOOFFSET(+90),
PATCH_UINT16(0x0114), // westernCliffs:y = 276
PATCH_END
};
static const uint16 ecoquest1SignatureNorthCliffsPosition[] = {
SIG_MAGICDWORD,
SIG_UINT16(0x00eb), // easternCliffs:x = 236
SIG_UINT16(0x0038), // easternCliffs:y = 56
SIG_ADDTOOFFSET(+88),
SIG_UINT16(0x0000), // westernCliffs:x = 0
SIG_UINT16(0x0032), // westernCliffs:y = 50
SIG_END
};
static const uint16 ecoquest1PatchNorthCliffsPosition[] = {
PATCH_ADDTOOFFSET(+2),
PATCH_UINT16(0x0138), // easternCliffs:y = 312
PATCH_ADDTOOFFSET(+90),
PATCH_UINT16(0x0132), // westernCliffs:y = 306
PATCH_END
};
static const uint16 ecoquest1SignatureNorthCliffsDisposal[] = {
0x39, SIG_SELECTOR8(init), // pushi init
0x76, // push0
0x72, SIG_ADDTOOFFSET(+2), // lofsa easternCliffs or westernCliffs
0x4a, SIG_MAGICDWORD, 0x04, // send 04 [ cliffs init: ]
0x38, SIG_SELECTOR16(obstacles), // pushi obstacles
SIG_END
};
static const uint16 ecoquest1PatchNorthCliffsDisposal[] = {
0x39, PATCH_SELECTOR8(dispose), // pushi dispose
PATCH_END
};
// The Spanish version of EcoQuest accidentally shipped with temporary test code
// that breaks the game when entering Olympia's apartment. (room 226)
//
// A message box's position was localized in the Spanish version. This message
// occurs after saving Olympia by pumping bleach out of the window. To test
// this change, a developer added code to forcibly run the usePump script upon
// entering the room, but then forgot to remove it. This breaks the puzzle and
// locks up the game upon re-entering the room.
//
// We fix this by disabling the test code that should not have been shipped.
//
// Applies to: Spanish PC Floppy
// Responsible method: rm226:init
// Fixes bug #10900
static const uint16 ecoquest1SignatureBleachPumpTest[] = {
SIG_MAGICDWORD,
0x78, // push1
0x39, 0x35, // pushi 35
0x46, SIG_UINT16(0x0333), // calle proc819_3 [ set recycled-bleach flag ]
SIG_UINT16(0x0003), 0x02,
0x38, SIG_SELECTOR16(setScript), // pushi setScript
0x78, // push1
0x72, SIG_UINT16(0x0a44), // lofsa usePump
0x36, // push
0x54, 0x06, // self 06 [ self setScript: usePump ]
SIG_END
};
static const uint16 ecoquest1PatchBleachPumpTest[] = {
0x32, PATCH_UINT16(0x0010), // jmp 0010 [ skip test code ]
PATCH_END
};
// script, description, signature patch
static const SciScriptPatcherEntry ecoquest1Signatures[] = {
{ true, 140, "CD: mosaic puzzle fix", 2, ecoquest1SignatureMosaicPuzzleFix, ecoquest1PatchMosaicPuzzleFix },
{ true, 160, "CD: give superfluous oily shell", 1, ecoquest1SignatureGiveOilyShell, ecoquest1PatchGiveOilyShell },
{ true, 160, "CD/Floppy: column puzzle fix", 1, ecoquest1SignatureColumnPuzzleFix, ecoquest1PatchColumnPuzzleFix },
{ true, 220, "CD: empty apartment messages", 1, ecoquest1SignatureEmptyApartmentMessages, ecoquest1PatchEmptyApartmentMessages },
{ true, 226, "Spanish: disable bleach pump test", 1, ecoquest1SignatureBleachPumpTest, ecoquest1PatchBleachPumpTest },
{ true, 320, "CD: south cliffs position", 1, ecoquest1SignatureSouthCliffsPosition, ecoquest1PatchSouthCliffsPosition },
{ true, 321, "CD: north cliffs position", 1, ecoquest1SignatureNorthCliffsPosition, ecoquest1PatchNorthCliffsPosition },
{ true, 321, "CD: north cliffs disposal", 2, ecoquest1SignatureNorthCliffsDisposal, ecoquest1PatchNorthCliffsDisposal },
{ true, 660, "CD: bad messagebox and freeze", 1, ecoquest1SignatureStayAndHelp, ecoquest1PatchStayAndHelp },
{ true, 816, "CD: prophecy scroll", 1, ecoquest1SignatureProphecyScroll, ecoquest1PatchProphecyScroll },
SCI_SIGNATUREENTRY_TERMINATOR
};
// ===========================================================================
// doMyThing::changeState (2) is supposed to remove the initial text on the
// ecorder. This is done by reusing temp-space, that was filled on state 1.
// this worked in sierra sci just by accident. In our sci, the temp space
// is resetted every time, which means the previous text isn't available
// anymore. We have to patch the code because of that.
// Fixes bug: #4993
static const uint16 ecoquest2SignatureEcorder[] = {
0x31, 0x22, // bnt [next state]
0x39, 0x0a, // pushi 0a
0x5b, 0x04, 0x1e, // lea temp[1e]
0x36, // push
SIG_MAGICDWORD,
0x39, 0x64, // pushi 64
0x39, 0x7d, // pushi 7d
0x39, 0x32, // pushi 32
0x39, 0x66, // pushi 66
0x39, 0x17, // pushi 17
0x39, 0x69, // pushi 69
0x38, SIG_UINT16(0x2631), // pushi 2631
0x39, 0x6a, // pushi 6a
0x39, 0x64, // pushi 64
0x43, 0x1b, 0x14, // callk Display
0x35, 0x0a, // ldi 0a
0x65, 0x20, // aTop ticks
0x33, // jmp [end]
SIG_ADDTOOFFSET(+1), // [skip 1 byte]
0x3c, // dup
0x35, 0x03, // ldi 03
0x1a, // eq?
0x31, // bnt [end]
SIG_END
};
static const uint16 ecoquest2PatchEcorder[] = {
0x2f, 0x02, // bt [to pushi 7]
0x3a, // toss
0x48, // ret
0x38, PATCH_UINT16(0x0007), // pushi 7d (parameter count) (waste 1 byte)
0x39, 0x0b, // pushi 11d (FillBoxAny)
0x39, 0x1d, // pushi 29d
0x39, 0x73, // pushi 115d
0x39, 0x5e, // pushi 94d
0x38, PATCH_UINT16(0x00d7), // pushi 215d
0x78, // push1 (visual screen)
0x38, PATCH_UINT16(0x0017), // pushi 23d (color) (waste 1 byte)
0x43, 0x6c, 0x0e, // callk Graph
0x38, PATCH_UINT16(0x0005), // pushi 5d (parameter count) (waste 1 byte)
0x39, 0x0c, // pushi 12d (UpdateBox)
0x39, 0x1d, // pushi 29d
0x39, 0x73, // pushi 115d
0x39, 0x5e, // pushi 94d
0x38, PATCH_UINT16(0x00d7), // pushi 215d
0x43, 0x6c, 0x0a, // callk Graph
PATCH_END
};
// Same patch as above for the ecorder introduction.
// Two workarounds are needed for this patch in workarounds.cpp (when calling
// kGraphFillBoxAny and kGraphUpdateBox), as there isn't enough space to patch
// the function otherwise.
// Fixes bug: #6467
static const uint16 ecoquest2SignatureEcorderTutorial[] = {
0x30, SIG_UINT16(0x0023), // bnt [next state]
0x39, 0x0a, // pushi 0a
0x5b, 0x04, 0x1f, // lea temp[1f]
0x36, // push
SIG_MAGICDWORD,
0x39, 0x64, // pushi 64
0x39, 0x7d, // pushi 7d
0x39, 0x32, // pushi 32
0x39, 0x66, // pushi 66
0x39, 0x17, // pushi 17
0x39, 0x69, // pushi 69
0x38, SIG_UINT16(0x2631), // pushi 2631
0x39, 0x6a, // pushi 6a
0x39, 0x64, // pushi 64
0x43, 0x1b, 0x14, // callk Display
0x35, 0x1e, // ldi 1e
0x65, 0x20, // aTop ticks
0x32, // jmp [end]
// 2 extra bytes, jmp offset
SIG_END
};
static const uint16 ecoquest2PatchEcorderTutorial[] = {
0x31, 0x23, // bnt [next state] (save 1 byte)
// The parameter count below should be 7, but we're out of bytes
// to patch! A workaround has been added because of this
0x78, // push1 (parameter count)
//0x39, 0x07, // pushi 7d (parameter count)
0x39, 0x0b, // pushi 11d (FillBoxAny)
0x39, 0x1d, // pushi 29d
0x39, 0x73, // pushi 115d
0x39, 0x5e, // pushi 94d
0x38, PATCH_UINT16(0x00d7), // pushi 215d
0x78, // push1 (visual screen)
0x39, 0x17, // pushi 23d (color)
0x43, 0x6c, 0x0e, // callk Graph