A Nightmare on Elm Street

I put this "structure" --> 0x1a237:
0d 06 00 02 0e 4f 75 69 0f 02 00 20 4e 6f 6e 00 0d 02 00....
I modified the two pointers 3c4c --> 3b26.
It works.
But, there is a default. In red on the screenshot.

 

It looks that game fills with grey all letters between 0E and 0Fh. See my screenshot: i added one letter to No, and moved right all other bytes (0F, 02, etc.) on the place of "OK".

If your change works other way, attach your EXE.

 

I do not understand. I modified this 4c4c pointer, because I always had Yes.
4c4c --> 4c26
Screenshot 00
There is no longer the default. Screenshot 01. It is weird. And there is always Yes.

--- добавлено 27 сен 2022, предыдущее сообщение размещено: 27 сен 2022 ---

Dream.exe file :
DREAM.7z

--- добавлено 27 сен 2022 ---

I made a mistake. I did not translate Yes...Sorry.

 

Does it means that you are now figured everything out and don't need me to research anything?

 

I understood what you well explained to me. But, there will surely be other technical problems, because there are always problems that arise during a translation.
Thank you very much for your help and your patience.

PS: Can we write your username in the credits, please?

 

You are welcome.

yes.

 

Thanks.
Good evenig.

 

Hi,
No problem, sorry.

 

Hi,

I have a big problem.
It is difficult to explain. If I move the free bytes after AMANDA.ANM. I have a piece of sentence that comes out when I quit the vending machine.

I send you these files:
DREAM good.EXE which has no problem.
DREAM problem who has the problem.
Save before the problem.

Could you help me, please.

Folder:
dream_1.zip

Thank you for your help.

 

Here is the code, that writes messages about vending machine (offset dseg:3290, as I see, you already changed it, because in original file it was offset dseg:32B3), question Yes/No (offset to structure is inside function "DisplayYesNo"), and some other message (offset dseg:32CD, this offset was not changed by you):

Код:

seg002:2788                 push    ds              ; case 0x1
seg002:2789                 mov     ax, 3290h
seg002:278C                 push    ax
seg002:278D                 call    DisplayMessage
seg002:2792                 mov     sp, bp
seg002:2794                 mov     ax, 1
seg002:2797                 push    ax
seg002:2798                 call    DisplayYesNo
seg002:279D                 pop     cx
seg002:279E                 or      ax, ax
seg002:27A0                 jz      short loc_9133
seg002:27A2                 call    sub_C5B2
seg002:27A7                 push    ds
seg002:27A8                 mov     ax, 32CDh
seg002:27AB                 push    ax
seg002:27AC                 call    DisplayMessage
seg002:27B1                 mov     sp, bp

In GOOD.EXE:

Код:

dseg:32C3                 db  6Dh ; m
dseg:32C4                 db  61h ; a
dseg:32C5                 db  63h ; c
dseg:32C6                 db  68h ; h
dseg:32C7                 db  69h ; i
dseg:32C8                 db  6Eh ; n
dseg:32C9                 db  65h ; e
dseg:32CA                 db  3Fh ; ?
dseg:32CB                 db  20h
dseg:32CC                 db    0
dseg:32CD                 db    0

We see that dseg:32CD is an empty message (starts with "db 0") located after message about vending machine.

In PROBLEM.EXE you placed at this offset (actually at this offset-1) this message:

Код:

dseg:32C1                 db  41h ; A
dseg:32C2                 db  4Dh ; M
dseg:32C3                 db  41h ; A
dseg:32C4                 db  4Eh ; N
dseg:32C5                 db  44h ; D
dseg:32C6                 db  41h ; A
dseg:32C7                 db  2Eh ; .
dseg:32C8                 db  41h ; A
dseg:32C9                 db  4Eh ; N
dseg:32CA                 db  4Dh ; M
dseg:32CB                 db    0
dseg:32CC                 db  54h ; T
dseg:32CD                 db  75h ; u
dseg:32CE                 db  20h
dseg:32CF                 db  61h ; a
dseg:32D0                 db  73h ; s
dseg:32D1                 db  20h
dseg:32D2                 db  74h ; t
dseg:32D3                 db  72h ; r
dseg:32D4                 db  6Fh ; o
dseg:32D5                 db  75h ; u
dseg:32D6                 db  76h ; v
dseg:32D7                 db  24h ; $

And now game displays this message

dseg:32CD aUAsTrouvLaMais db 'u as trouv$ la maison de Freddy !',0Dh,0

instead of empty message that was at this offset before!

You should change pointer 32CD at seg002:27A8 to point to some empty message (to some "db 0").

 

Hi,
My error is fixed.

A little question.
When there is twice 00 (2x00 or 00 00). I must to modify the pointer of the second 00?

Thank you for your help.

 

First 00 is the end of previous message.
Second 00 is the next empty message. It has its own pointer in code:

Код:

seg002:2851                 mov     ax, 332Bh
...
seg002:2875                 mov     ax, 333Eh
...
dseg:332B aGoUpTheLadder? db 'Go up the ladder? ',0 ; DATA XREF: sub_90D9+F8o
dseg:333E unk_1907E       db    0                 ; DATA XREF: sub_90D9+11Co

If you would not modify pointer to empty messages they will became pointers to some garbage like it was with code working after exiting Vending Machine.

How to find pointers like this? Use process described in my first post in paragraph 5 to find all pointers,

 

I understood.
I thank you for your explanations.

 

I finished the DREAM.EXE file...
The person translating this game gave up because of the pointers. I would like to finish this translation.
I have a problem with LEVELS.BIN file. English sentences are short. It is difficult to translate.
Here ys what I tried:
1) Unzip the LEVELS.BIN file as for the DREAM.EXE file... I can not unzip it "MS-DOS executable (EXE) [dos.ldw]. Screenshot 200.
2) Expand BIN file. Screenshot 201. But I can not find the pointers or if the added text is taken into account by the game.
I replaced the pointer 7903 with 3986. Nothing.
I added 01DA (474) to the last pointer (1a58). 1a58 + 1da = 1c32. Nothing. Screenshot 203.

Could you help me, please?

--- добавлено 1 окт 2022, предыдущее сообщение размещено: 1 окт 2022 ---

My LEVELS.BIN file :
LEVELS.7z

 

IDA helps with executables only. For data files (like LEVEL.BIN) it is not better than any Hex-editor.


Can you give me a savegame just before game displays some message from levels.bin? Write what to do to see this message. And give me your DREAM.EXE (in case if savegame is bound to changed pointers in EXE)

 

Hi,

I send you the folder with DREAM.EXE, LEVELS.BIN, FREDDYA.SAV and two folders:
dream


For bin 0332 folder, I took over the pointers from the last text block.

For bin bin 1f86 folder, I added all the bytes from the text of the first block of texts.

--- добавлено 2 окт 2022, предыдущее сообщение размещено: 2 окт 2022 ---

Here is the text I added at the end of LEVELS.BIN file:
You have bested all of Freddy's perilous traps and defeated his inhuman army of evil. Now, one task remains. You must destroy Freddy Krueger in this final battle, or he will destroy you and you will never awaken from his hideous nightmares. But I will offer you aid by healing you up to your full potential, and give you two strong-souled friends to help you in this battle. You have proven yourself worthy, now be strong in spirit and GO KICK FREDDY'S EVIL BUTT!!<bh:06>

--- добавлено 2 окт 2022 ---

PS:
Pointers are before the text block.

 

Simply speaking, format of LEVELS.BIN as I see it is:
1. FAT pointing to level blocks
2. Level blocks, one after another.

Game reads FAT (16h bytes):

Код:

seg001:131D                 mov     ax, offset s1   ; "LEVELS.BIN"
seg001:1320                 push    ax              ; s1
seg001:1321                 call    openFile
...
seg001:1330                 mov     ax, 16h
seg001:1333                 push    ax              ; len
seg001:1334                 push    ss
seg001:1335                 lea     ax, [bp+buf]
seg001:1338                 push    ax              ; buf
seg001:1339                 push    si              ; handle
seg001:133A                 call    _read

Gets pointer to required level block (number of required level block is in arg_0) from FAT:

Код:

seg001:1345                 mov     bx, [bp+arg_0]
seg001:1348                 shl     bx, 1
seg001:134A                 lea     ax, [bp+buf]
seg001:134D                 add     bx, ax
seg001:134F                 mov     ax, ss:[bx]
seg001:1352                 cwd

Seeks in file to pointed position:

Код:

seg001:1353                 push    dx
seg001:1354                 push    ax              ; offset
seg001:1355                 push    si              ; handle
seg001:1356                 call    _lseek

Reads full level block to memory:

Код:

seg001:135E                 mov     ax, 7500
seg001:1361                 push    ax              ; len
seg001:1362                 push    word ptr buf+2
seg001:1366                 push    word ptr buf    ; buf
seg001:136A                 push    si              ; handle
seg001:136B                 call    _read

And closes file LEVELS.BIN:

Код:

seg001:1370                 add     sp, 8
seg001:1373                 push    si              ; handle
seg001:1374                 call    _close

What do I understood from this code:

1. Maximum size of block is 7500. Game will not read any more from LEVELS.BIN (until entering next level)
2. Pointers inside those blocks can't point outside of the block. When you changed pointer from first (second?) block to point to the end of file - it was not possible for the game to read this additional text and in game this pointer points to some garbage.
3. You probably can enlarge blocks until their size reaches 7500 bytes (you should move other blocks and patch FAT) - just my assumptions.

Result:
bin 1f86 will not work. Game reads 7500 bytes at once and all pointers and text should be inside this buffer.
bin 0332 - as i see it mainly works, except for the dagger, where you pointer for it points to the middle of some other string. Why did you written such pointer ?

 

I do not remember. I tried many things. I had tried to take the last pointer of the last block of text which is 1a58+01DA (474 bytes)= 1C32 And I wrote 1C32 instead of 7903.

Yesterday I had added "Demandez" (8 letters). The game crashes. Scrennshot.
This is why I looked for another solution.

I do not know how to patch FAT. How do we do it, please?
Because Nocturne (it is the person I was helping) had enlarged the first blocks for his translation, but without changing the value of the pointers.
I send you its LEVELS.BIN file.
LEVELS.7z
PS:Pointers are not good.

 

Think of FAT as a list of pointers to large blocks of file. Here is the FAT from LEVELS.BIN:

Код:

0000000000: 18 00 26 00 C4 03 EC 08 │ 86 0D 62 14 12 22 5F 37
0000000010: D6 4A 03 56 AB 6B DF 87 

Start of first block: 0018h (I don't know why this block is so small)
Start of second block: 0026h
Start of third block: 03C4h
...
Start of last block: 6BABh
point of end of file: 87DFh

When game need to load block for level with slimy walls (savegame you gave me for Vending Machine) it reads from FAT value 0D86h and reads 7500 bytes starting from 0D86h.

So if you enlarge any block then you have to modify all pointers in FAT that point to blocks that were moved to new places. If you enlarged second block then you have to modify pointers to third and all other blocks accordingly. You have to do it for game to load those blocks from their new positions because now block for level with slimy walls will start not at 0D86h.

 

I think 00 26 is the first block. Because there are ten blocks of text and twelve pointers. One text block per level. And 0D86 is the fourth block (Level 4 in the game).

If I understood correctly. If I add 10 bytes (example) to the second block. I need to add 10 bytes to all other blocks (third, fourth, etc). It is correct ?

I thank you very much for your help.

PS: Finished files;
a nightmare on elm street RU