2
cseg01:0001F4D8                 mov     Disk_Letter, 43h ; 'C'
cseg01:0001F4DF
cseg01:0001F4DF loc_1F4DF:                              ; CODE XREF: sub_1F4C8+60j
cseg01:0001F4DF                 xor     eax, eax
cseg01:0001F4E1                 mov     al, Disk_Letter
cseg01:0001F4E6                 push    eax
cseg01:0001F4E7                 push    offset aCDataTitle_phd ; "%c:\\data\\title.phd"
cseg01:0001F4EC                 lea     eax, [esp+2Ch+var_24]
cseg01:0001F4F0                 push    eax
cseg01:0001F4F1                 call    sprintf_
cseg01:0001F4F6                 add     esp, 0Ch
cseg01:0001F4F9                 mov     edx, offset aRb_4 ; "rb"
cseg01:0001F4FE                 mov     eax, esp
cseg01:0001F500                 call    fopen_
cseg01:0001F505                 test    eax, eax
cseg01:0001F507                 jz      short loc_1F517
cseg01:0001F509                 call    fclose_
cseg01:0001F50E                 call    sub_1F544
cseg01:0001F513                 test    eax, eax
cseg01:0001F515                 jnz     short loc_1F53E
cseg01:0001F517
cseg01:0001F517 loc_1F517:                              ; CODE XREF: sub_1F4C8+3Fj
cseg01:0001F517                 mov     dl, Disk_Letter
cseg01:0001F51D                 inc     dl
cseg01:0001F51F                 mov     Disk_Letter, dl
cseg01:0001F525                 cmp     dl, 5Ah ; 'Z'
cseg01:0001F528                 jbe     short loc_1F4DF

cseg01:0001F544 sub_1F544       proc near               ; CODE XREF: sub_1F4C8+46p
cseg01:0001F544
cseg01:0001F544 var_19          = byte ptr -19h
cseg01:0001F544 var_10          = byte ptr -10h
cseg01:0001F544
cseg01:0001F544                 push    ebx
cseg01:0001F545                 push    edx
cseg01:0001F546                 sub     esp, 10h
cseg01:0001F549                 xor     ebx, ebx
cseg01:0001F54B
cseg01:0001F54B loc_1F54B:                              ; CODE XREF: sub_1F544+26j
cseg01:0001F54B                 call    GetRandomControl
cseg01:0001F550                 imul    edx, eax, 1Ah
cseg01:0001F553                 mov     eax, edx
cseg01:0001F555                 sar     edx, 1Fh
cseg01:0001F558                 shl     edx, 0Fh
cseg01:0001F55B                 sbb     eax, edx
cseg01:0001F55D                 sar     eax, 0Fh
cseg01:0001F560                 inc     ebx
cseg01:0001F561                 add     al, 41h ; 'A'
cseg01:0001F563                 mov     [esp+ebx+18h+var_19], al
cseg01:0001F567                 cmp     ebx, 8
cseg01:0001F56A                 jl      short loc_1F54B
cseg01:0001F56C                 xor     ah, ah
cseg01:0001F56E                 mov     [esp+18h+var_10], ah
cseg01:0001F572                 mov     eax, esp
cseg01:0001F574                 mov     edx, offset aWb ; "wb"
cseg01:0001F579                 call    sub_1F4A4
cseg01:0001F57E                 mov     ebx, eax
cseg01:0001F580                 call    fopen_
cseg01:0001F585                 test    eax, eax
cseg01:0001F587                 jz      short loc_1F599
cseg01:0001F589                 call    fclose_
cseg01:0001F58E                 mov     eax, ebx
cseg01:0001F590                 call    j_unlink_
cseg01:0001F595                 xor     eax, eax
cseg01:0001F597                 jmp     short loc_1F59E
cseg01:0001F599 ; ---------------------------------------------------------------------------
cseg01:0001F599
cseg01:0001F599 loc_1F599:                              ; CODE XREF: sub_1F544+43j
cseg01:0001F599                 mov     eax, 1
cseg01:0001F59E
cseg01:0001F59E loc_1F59E:                              ; CODE XREF: sub_1F544+53j
cseg01:0001F59E                 add     esp, 10h
cseg01:0001F5A1                 pop     edx
cseg01:0001F5A2                 pop     ebx
cseg01:0001F5A3                 retn
cseg01:0001F5A3 sub_1F544       endp

cseg01:0002043C GetRandomControl proc near              ; CODE XREF: sub_1BB1C+3Cp
cseg01:0002043C                                         ; sub_1D754+40p ...
cseg01:0002043C                 imul    eax, rand_2, 41C64E6Dh
cseg01:00020446                 add     eax, 3039h
cseg01:0002044B                 mov     rand_2, eax
cseg01:00020450                 sar     eax, 0Ah
cseg01:00020453                 and     eax, 7FFFh
cseg01:00020458                 retn
cseg01:00020458 GetRandomControl endp

cseg01:0001F4A4 sub_1F4A4       proc near               ; CODE XREF: sub_10ED0+6Bp
cseg01:0001F4A4                                         ; sub_1E2EC+Cp ...
cseg01:0001F4A4                 push    eax
cseg01:0001F4A5                 xor     eax, eax
cseg01:0001F4A7                 mov     al, Disk_Letter
cseg01:0001F4AC                 push    eax
cseg01:0001F4AD                 push    offset aCS      ; "%c:\\%s"
cseg01:0001F4B2                 push    offset unk_CE5FC
cseg01:0001F4B7                 call    sprintf_
cseg01:0001F4BC                 mov     eax, offset unk_CE5FC
cseg01:0001F4C1                 add     esp, 10h
cseg01:0001F4C4                 retn
cseg01:0001F4C4 sub_1F4A4       endp

Disassembling MS DOS game (C++ WATCOM compiler 32 bit). I not understand what give to us calling GetRandomControl and how arranged CD ROM device check in function sub_1F544?

1
  • 1
    we have no idea what your goals are - "what give to us calling GetRandomControl" - do you want to know what the function returns? "and how to arrange CD ROM device check" - do you want to disable a CD check? please write at least some sentences, what game, what goals, do you just want to analyse the game, reverse it, patch it - its not clear
    – llm
    Feb 25, 2023 at 7:17

1 Answer 1

0

This code below produce 8 random letters for file name. A very interesting division algorithm with a remainder of 26 - 1Ah (the number of letters in the alphabet). Function GetRandomControl returns random number (based on time() and localtime()).

cseg01:0001F54B loc_1F54B:                              ; CODE XREF: sub_1F544+26j
cseg01:0001F54B                 call    GetRandomControl
cseg01:0001F550                 imul    edx, eax, 1Ah
cseg01:0001F553                 mov     eax, edx
cseg01:0001F555                 sar     edx, 1Fh
cseg01:0001F558                 shl     edx, 0Fh
cseg01:0001F55B                 sbb     eax, edx
cseg01:0001F55D                 sar     eax, 0Fh
cseg01:0001F560                 inc     ebx
cseg01:0001F561                 add     al, 41h ; 'A'
cseg01:0001F563                 mov     [esp+ebx+18h+var_19], al
cseg01:0001F567                 cmp     ebx, 8
cseg01:0001F56A                 jl      short loc_1F54B

This code below trying this filename to write on the current disk. If write operation is failed - this is CD. unlink function delete file if write operation succes (this is not CD).

cseg01:0001F56C                 xor     ah, ah
cseg01:0001F56E                 mov     [esp+18h+var_10], ah
cseg01:0001F572                 mov     eax, esp
cseg01:0001F574                 mov     edx, offset aWb ; "wb"
cseg01:0001F579                 call    sub_1F4A4
cseg01:0001F57E                 mov     ebx, eax
cseg01:0001F580                 call    fopen_
cseg01:0001F585                 test    eax, eax
cseg01:0001F587                 jz      short loc_1F599
cseg01:0001F589                 call    fclose_
cseg01:0001F58E                 mov     eax, ebx
cseg01:0001F590                 call    j_unlink_

By analogy algorithm to produce 8 random letters on C++.

#include <iostream>
using namespace std;

#include <time.h>

int rand_2;

int GetRandomDraw( void )
{
    rand_2 = rand_2 * 0x41c64e6d + 0x3039;
    return( ( rand_2 >> 10 )&0x7fff );
}

int main(void)
{
    struct tm   *tptr;
    time_t      lt;

    lt = time(NULL);
    tptr = localtime(&lt);
    rand_2 = tptr->tm_sec+(tptr->tm_min*43)+(tptr->tm_hour*3477);

    for ( int i = 0; i < 8; i++ )
    {

        int val = GetRandomDraw();

        val = val % 26;

        char ch_my = (unsigned char) val + 0x41;

        printf("%c", ch_my);

    }

    printf("\n");

    return 0;
}
2
  • 1
    is there still a question?
    – llm
    Feb 28, 2023 at 16:28
  • I figured it out, thanks.
    – black4
    Mar 1, 2023 at 10:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.