Sierra’s Macintosh Timebomb
On Saturday, September 18 1993, Sierra’s Macintosh video games stopped working. Franchises froze as King’s Quests, House Quests, and even the Leisurely Suited Larries locked up. Virtually each Mac SCI game had damaged in a single day. Sierra developed a patch inside 9 days, launched it on their BBS, and introduced it of their magazine. Anybody who wrote in obtained a free patch disk within the mail. The MCDATE patch was a Mac program that fastened virtually any recreation you pointed it at. And but right here sooner or later, they’re failing over again. What went incorrect?
The Queen Mum is a famous masteress of suspense, however not for this
Every Mac recreation appears to lock up otherwise however they’re all doing the identical factor: ready means too lengthy for a pause to finish. Particularly, the video games dangle after they set a delay on a Script object in seconds. SCI video games are full of those quick delays and now they carry every part to a halt. King’s Quest VI cannot even end its opening copyright message due to a 3 second pause that by no means appears to finish.
Timing is difficult in SCI, however for at the moment we simply must know that Script delays in seconds are applied by polling the system clock for modifications. Scripts do not wait for 3 seconds, they wait for 3 clock modifications. It would not matter what any of these occasions are so long as they’re completely different than earlier than. That is a fairly large clue. Simply by wanting on the scripts we are able to inform that the one means this scheme can get caught is that if the clock will get caught, and scripts get their clock time from KGetTime.
The Okay in KGetTime stands for Kernel. Kernel features reside in Sierra’s interpreter for recreation scripts to name. Sierra ported SCI video games to Mac by first changing the SCI interpreter to a Mac program, and that meant rewriting a whole lot of code to do issues the Mac means. Studying the clock is a kind of low-level issues that is so completely different between platforms that it must be rewritten for every. That makes KGetTime a terrific candidate for a Mac-only bug.
KGetTime has a number of modes to supply occasions in several codecs. Our Mac issues happen when Script delays name KGetTime(1) so that is the one we’ll deal with. KGetTime(1) returns the time of day in a 16-bit format: HHHH MMMM MMSS SSSS
If a recreation needs to show the present time then it calls KGetTime(1) and unpacks these particular person values, but when it is solely trying to see if time has modified then it simply shops the consequence and compares it to the subsequent. Sadly some pope crammed too many seconds in a day and 16 bits aren’t sufficient to carry them. You want 17 bits for that, so KGetTime(1) compromises by limiting the hours to 12. If you’ll want to know which half of the day it’s then you definitely use KGetTime(2), which compromises on the opposite finish by limiting the decision to each 2 seconds. Script delays solely wish to know when the seconds change so KGetTime(1) does the job. Though, that does imply all that bit packing is a waste of time, in like… a pair methods.
KGetTime seems to be only a small wrapper perform. SysTime is the place the true work is completed.
2038 020c transfer.l Time, d0 80fc a8c0 divu.w #$a8c0, d0 4840 swap d0 0280 0000 ffff andi.l #$ffff, d0 80fc 003c divu.w #60, d0 7200 moveq #0, d1 3200 transfer.w d0, d1 4840 swap d0 82fc 003c divu.w #60, d1 3401 transfer.w d1, d2 4841 swap d1 ed49 lsl.w #6, d1 8041 or.q d1, d0 123c 000c transfer.b #12 ,d1 e36a lsl.w d1, d2 8042 or.w d2, d0
Macintosh clock time is the variety of seconds since midnight on January 1 1904. The working system updates the Time international variable each second. SysTime(1) solely cares concerning the present 12 hour interval so it divides Time by 12 hours ($A8C0 seconds) and takes the rest. From there it calculates the hours and minutes and remaining seconds and packages them up in 16 candy bits. All of this sounds good, however we all know there’s an issue right here that includes September 18 1993. $A8C0 is the one fascinating fixed, so let’s examine that second instruction.
The Motorola 68000 processor’s DIVU instruction divides a 32-bit unsigned integer by a 16-bit unsigned integer and places the quotient within the decrease 16 bits and the rest within the higher 16. For those who solely care concerning the the rest then you definitely swap ’em and clear the higher bits, identical to SysTime does. However DIVU can fail.
Overflow could also be detected and set earlier than the instruction completes. If the instruction detects an overflow, it units the overflow situation code, and the operands are unaffected.
If Time will get too massive then DIVU will not do something however SysTime will proceed as if it had. SysTime will then cheerfully swap the bits from the Macintosh clock time, throw away the helpful ones that change each second, and hold the lifers that solely budge each 18 hours. At that time the remainder of the code retains producing the identical consequence for fairly some time and the clock is successfully caught. Time will get too massive when dividing by $A8C0 produces a solution that does not slot in 16 bits. As soon as that reply reaches $10000 the timebomb goes off. In accordance with NumberWang, $A8C0 occasions $10000 is $A8C00000, or as its extra colloquially identified: the 2 billion eight hundred and thirty a million 100 and fifty 5 thousand and 2 hundred seconds between January 1 1904 and September 18 1993.
What horrible luck! Look, all the software program improvement career and a number of other of its extra profitable subfields are based mostly on each programmer cranking out a dozen overflows a day. That is a given. However the Sierra programmer tasked with Mac SysTime in 1990 was working with a 136 12 months format that also had one other 50 good years on it. And but dividing by 12 hours occurred to mild a fuse so quick that it will solely run out as soon as the code was in everybody’s houses and nonetheless on the cabinets. Mac SCI was born with barely 4 years to reside! That may drive you completely Batty.
Oh properly, it is only a division overflow. There are many methods to work round that once you solely care concerning the the rest. Or hey, you could possibly use Mac’s Secs2Date perform that does this be just right for you, and SysTime(3) already calls that. Patching binaries is difficult, particularly below stress, however not less than Sierra had choices. I am unable to wait to see how they fastened this!
2038 020c transfer.l Time, d0 + 0480 19bf cc00 subi.l #$19bfcc00, d0 ; subtract 5,000 days 80fc a8c0 divu.w #$a8c0, d0 4840 swap d0 0280 0000 ffff andi.l #$ffff, d0 .... ....
Oh so that is how we fastened Y2K. I positive hope we subtracted an even bigger quantity! $19BFCC00 is 432,000,000 seconds which is 5,000 days which is 13.6 years which is sort of a Weapons N Roses track. Sierra did not disarm the rattling bomb! They simply lashed on extra fuse with a granny knot. I wish to make enjoyable of kicking the can right down to Could 28 2007, however that turned out to be a beneficiant evaluation of traditional Mac’s future. Right here in our future, these 5,000 days blew by and these video games are again to blowing up. However now they explode in emulators the place you possibly can’t all the time change their clock to work round it. And altering your clock is an train in Kaczynskism that detonates your TLS connections and takes you off the grid.
Truly we most likely ought to make enjoyable of this as a result of it will get worse. It might be one factor if this was a short lived repair. In any case, patching a fleet of binaries within the wild means working below a whole lot of constraints. However no, bumping the incept date was Sierra’s everlasting resolution. Future video games with newer interpreters shipped with this identical code as an alternative of merely checking for overflow. Because of this, there at the moment are extra Mac video games with this bug than when it was fastened.
Properly, Sierra fudged it, however they weren’t the one ones to strive. Enrico Rolfi is a legendary SCI hacker of the Italian persuasion who reverse engineered a whole lot of useful resource codecs earlier than it was cool. His TraduSCI software program has allowed followers to fully translate Sierra video games to different languages since 2004. Astoundingly, he is nonetheless at it! Two months in the past he launched a new version that integrates with Google Translate. I am terribly impressed, and I take consolation that another person maintains their Bush-era Home windows software program and forgets their weblog for years.
In 2002, Enrico resurrected Space Quest III and Space Quest IV to run on newer Macintoshes, and that meant taking over KGetTime. Enrico’s patched variations nonetheless run at the moment it doesn’t matter what 12 months it’s. Success! However they do not repair SysTime, they skip it. As a substitute, KGetTime ignores the mode parameter from the sport scripts and all the time returns the tick counter. The interpreter increments this each 1/sixtieth of second, so whereas Script delays not dangle, they now run 60 occasions too quick. I do know some folks who would love this…
Did somebody draw the Sierra emblem in Child Pix?
So what have we realized at the moment? We have realized why Sierra’s Mac video games froze on September 18 1993. We have realized how a shoddy repair froze them once more on March 28 2007. And we have realized that they had been by no means really frozen; Mac customers had been simply too impatient for a 3 day copyright message. However most significantly, we have realized that Y2K will nonetheless homicide us all in our sleep.*
Right here sooner or later, can we do any higher? Pfft, perhaps you can, the entire thing’s a correct mess innit? Every recreation’s interpreter is completely different and now they’re patched or unpatched or post-patch or fan-patched. And patching these outdated packages your self is not easy; the code is in Mac useful resource forks and people forks are compressed. For those who had been actually crazed, you could possibly write a correct SysTime in m68k meeting with overflow checks and use ResEdit to patch that into Sierra’s patcher. Severely, if you happen to can hold yours inside 178 bytes you possibly can change the wonky SysTime at Knowledge useful resource 128. You are by yourself for making use of that to post-patch video games. That is a whole lot of work when we have now ScummVM, which already goes out of its approach to run Sierra’s outdated Mac variations on all fashionable platforms. Traditional Mac has sunk — all people into the lifeboat!
In fact the true impediment to fixing Sierra’s Mac video games is that no person cares. And why would they? It is by no means been simpler to run Sierra video games, in the meantime the Mac variations are more and more inaccessible and boring. They’re simply ports of the DOS variations. Apart from a number of Mac gimmicks, the video games themselves do not convey something new to the desk. Though, there’s one exception…
Subsequent time: Mo’ Mac? Possibly!