actually I think Girl_One_Cheezy_Fashion is the username.

The password is bfs~^abcdefg~^

I was wrong on both counts! I netcatted it, and it turns out "Girl_One_Cheezy_Fashion" is indeed the filename, and the bfs~^abcdefg~^ is the "bfs_authenticate".

I hacked the EXE to upload to localhost. The game originally pointed at vvjpgxfr.barbie.com, which is a domain that doesn't exist anymore and there are no references to it online that I can find

this is what it uploads, btw

I had to name the game-specific allocation and free functions, and this is a barbie game, so of course they're barbie_malloc and barbie_free.

Every time I see those it makes me smile. Barbie is a C++ programmer now! with barbie_malloc!

yeah the bastard thing is loading "files" named like "E13841F5C_00.PRM", and that string is located in memory at the suspiciously similar location of 0x13949D8C.

these are not files. these are memory!

ahh, fun. they are running python 2.2, which is prior to python having booleans.

so one of the first lines they run is "false=0;true=1"