then they've got 10 digits, 26 letters, and 8 sporty icons. 44 in total.
You'll never guess what filenames those 44 images have
oh hey I see now why they have the debug_mode global boolean turned off.
this game is spewing CONSTANT error messages.
"PR: (ERROR) PR_SelectTexture Parameter 1 is out of range (0 to 228). Value was -4"
I'm not sure why this error message is being generated (though I have a guess and it involves this untextured desk stand) but it's coming out at least once per frame
so they load 68 files named Patterns01.tga when you click the desk, but the function PR_LoadTGA is never called?
suspicious.
I'll set a breakpoint on PR_LoadPRO (the proprietary file format for this engine), PR_LoadPNG (a sensible choice), PR_LoadBMP (it's a windows game, so maybe).
PR_LoadPCX and PR_LoadLBM... yeah let's not bother.
I think they did finally figure out an engine name, based on these function names.
It's "R0"
Hey, it's something, I guess.
It's got a feature to upload your designs to the barbie website, and I think it internally calls all user uploads "Girl_One_Cheezy_Fashion"
__stdcall my beloved. best x86 calling convention ever.
how do we pass arguments? you stick them on the stack, right to left. return values are in EAX.
it's so fucking simple I love it
actually I think Girl_One_Cheezy_Fashion is the username.
The password is bfs~^abcdefg~^
I was wrong on both counts! I netcatted it, and it turns out "Girl_One_Cheezy_Fashion" is indeed the filename, and the bfs~^abcdefg~^ is the "bfs_authenticate".
User-Agent: Barbie Fashion Show
IT'S INTERNET EXPLORER, STOP LYING TO THE WEB
I hacked the EXE to upload to localhost. The game originally pointed at vvjpgxfr.barbie.com, which is a domain that doesn't exist anymore and there are no references to it online that I can find
I had to name the game-specific allocation and free functions, and this is a barbie game, so of course they're barbie_malloc and barbie_free.
Every time I see those it makes me smile. Barbie is a C++ programmer now! with barbie_malloc!
yeah the bastard thing is loading "files" named like "E13841F5C_00.PRM", and that string is located in memory at the suspiciously similar location of 0x13949D8C.
these are not files. these are memory!
ahh, fun. they are running python 2.2, which is prior to python having booleans.
so one of the first lines they run is "false=0;true=1"