Freddy Pharkas (Mac) easter egg

[OmerMor]

Someone over the scummvm forums is trying to unveil a rare easter egg in the Mac version of Freddy Pharkas.
You can read his question here: http://forums.scummvm.org/viewtopic.php?t=14014

I tried to decompile or disassemble the relevant script (270), but since it's a mac it uses a different format (I think big endian instead of little endian), and existing tools choke on it.
Scummvm is able to run the game, and I managed to disassemble some functions with their debugger, but I still find it hard to work that way, and I'm not that great at understand the SCI assembly.

Here is what I managed to disassemble:

Code: [Select]

rm270::doit

002c:0501: lap 01
002c:0503: aTop 14
002c:0505: push
002c:0506: dup
002c:0507: ldi 00
002c:0509: eq?
002c:050a: bnt 24  [0530]
002c:050c: pushi 018b
002c:050f: push0
002c:0510: lag 01
002c:0512: send 04
002c:0514: pushi 6f
002c:0516: push0
002c:0517: lofsa 00c6
002c:051a: send 04
002c:051c: pushi 00aa
002c:051f: pushi 06
002c:0521: dup
002c:0522: push2
002c:0523: push0
002c:0524: push0
002c:0525: pushSelf
002c:0526: pushi 010e
002c:0529: lag 5b
002c:052b: send 10
002c:052d: jmp 0125  [0655]
002c:0530: dup
002c:0531: ldi 01
002c:0533: eq?
002c:0534: bnt 15  [054b]
002c:0536: pushi 00aa
002c:0539: pushi 06
002c:053b: dup
002c:053c: push0
002c:053d: pushi 07
002c:053f: push0
002c:0540: pushSelf
002c:0541: pushi 010e
002c:0544: lag 5b
002c:0546: send 10
002c:0548: jmp 010a  [0655]
002c:054b: dup
002c:054c: ldi 02
002c:054e: eq?
002c:054f: bnt 12  [0563]
002c:0551: pushi 28
002c:0553: push1
002c:0554: pushi 0bb6
002c:0557: pushi 27
002c:0559: push1
002c:055a: pushSelf
002c:055b: lofsa 054e
002c:055e: send 0c
002c:0560: jmp 00f2  [0655]
002c:0563: dup
002c:0564: ldi 03
002c:0566: eq?
002c:0567: bnt 13  [057c]
002c:0569: pushi 00aa
002c:056c: pushi 05
002c:056e: pushi 06
002c:0570: push0
002c:0571: pushi 08
002c:0573: push0
002c:0574: pushSelf
002c:0575: lag 5b
002c:0577: send 0e
002c:0579: jmp 00d9  [0655]
002c:057c: dup
002c:057d: ldi 04
002c:057f: eq?
002c:0580: bnt 12  [0594]
002c:0582: pushi 28
002c:0584: push1
002c:0585: pushi 0bb7
002c:0588: pushi 27
002c:058a: push1
002c:058b: pushSelf
002c:058c: lofsa 054e
002c:058f: send 0c
002c:0591: jmp 00c1  [0655]
002c:0594: dup
002c:0595: ldi 05
002c:0597: eq?
002c:0598: bnt 13  [05ad]
002c:059a: pushi 00aa
002c:059d: pushi 05
002c:059f: pushi 06
002c:05a1: push0
002c:05a2: pushi 09
002c:05a4: push0
002c:05a5: pushSelf
002c:05a6: lag 5b
002c:05a8: send 0e
002c:05aa: jmp 00a8  [0655]
002c:05ad: dup
002c:05ae: ldi 06
002c:05b0: eq?
002c:05b1: bnt 13  [05c6]
002c:05b3: pushi 00aa
002c:05b6: pushi 05
002c:05b8: pushi 06
002c:05ba: push0
002c:05bb: pushi 0a
002c:05bd: push0
002c:05be: pushSelf
002c:05bf: lag 5b
002c:05c1: send 0e
002c:05c3: jmp 008f  [0655]
002c:05c6: dup
002c:05c7: ldi 07
002c:05c9: eq?
002c:05ca: bnt 14  [05e0]
002c:05cc: pushi 00e1
002c:05cf: push0
002c:05d0: pushi 00a1
002c:05d3: push2
002c:05d4: class 1c
002c:05d6: push
002c:05d7: pushSelf
002c:05d8: lofsa 0336
002c:05db: send 0c
002c:05dd: jmp 0075  [0655]
002c:05e0: dup
002c:05e1: ldi 08
002c:05e3: eq?
002c:05e4: bnt 19  [05ff]
002c:05e6: pushi 03
002c:05e8: push1
002c:05e9: push0
002c:05ea: pushi 04
002c:05ec: push1
002c:05ed: pushi 0f
002c:05ef: pushi 00a1
002c:05f2: push2
002c:05f3: class 1d
002c:05f5: push
002c:05f6: pushSelf
002c:05f7: lofsa 0336
002c:05fa: send 14
002c:05fc: jmp 0056  [0655]
002c:05ff: dup
002c:0600: ldi 09
002c:0602: eq?
002c:0603: bnt 0e  [0613]
002c:0605: pushi 66
002c:0607: push0
002c:0608: lofsa 0336
002c:060b: send 04
002c:060d: ldi 02
002c:060f: aTop 1c
002c:0611: jmp 42  [0655]
002c:0613: dup
002c:0614: ldi 0a
002c:0616: eq?
002c:0617: bnt 12  [062b]
002c:0619: pushi 00aa
002c:061c: pushi 05
002c:061e: pushi 06
002c:0620: push0
002c:0621: pushi 0b
002c:0623: push0
002c:0624: pushSelf
002c:0625: lag 5b
002c:0627: send 0e
002c:0629: jmp 2a  [0655]
002c:062b: dup
002c:062c: ldi 0b
002c:062e: eq?
002c:062f: bnt 0e  [063f]
002c:0631: pushi 018c
002c:0634: push0
002c:0635: lag 01
002c:0637: send 04
002c:0639: ldi 01
002c:063b: aTop 1a
002c:063d: jmp 16  [0655]
002c:063f: dup
002c:0640: ldi 0c
002c:0642: eq?
002c:0643: bnt 10  [0655]
002c:0645: pushi 6e
002c:0647: push0
002c:0648: pushi 66
002c:064a: push0
002c:064b: lofsa 00c6
002c:064e: send 08
002c:0650: pushi 6f
002c:0652: push0
002c:0653: self 04
002c:0655: toss
002c:0656: ret
----------------------------------------
macThing::changeState

002c:0501: lap 01
002c:0503: aTop 14
002c:0505: push
002c:0506: dup
002c:0507: ldi 00
002c:0509: eq?
002c:050a: bnt 24  [0530]
002c:050c: pushi 018b
002c:050f: push0
002c:0510: lag 01
002c:0512: send 04
002c:0514: pushi 6f
002c:0516: push0
002c:0517: lofsa 00c6
002c:051a: send 04
002c:051c: pushi 00aa
002c:051f: pushi 06
002c:0521: dup
002c:0522: push2
002c:0523: push0
002c:0524: push0
002c:0525: pushSelf
002c:0526: pushi 010e
002c:0529: lag 5b
002c:052b: send 10
002c:052d: jmp 0125  [0655]
002c:0530: dup
002c:0531: ldi 01
002c:0533: eq?
002c:0534: bnt 15  [054b]
002c:0536: pushi 00aa
002c:0539: pushi 06
002c:053b: dup
002c:053c: push0
002c:053d: pushi 07
002c:053f: push0
002c:0540: pushSelf
002c:0541: pushi 010e
002c:0544: lag 5b
002c:0546: send 10
002c:0548: jmp 010a  [0655]
002c:054b: dup
002c:054c: ldi 02
002c:054e: eq?
002c:054f: bnt 12  [0563]
002c:0551: pushi 28
002c:0553: push1
002c:0554: pushi 0bb6
002c:0557: pushi 27
002c:0559: push1
002c:055a: pushSelf
002c:055b: lofsa 054e
002c:055e: send 0c
002c:0560: jmp 00f2  [0655]
002c:0563: dup
002c:0564: ldi 03
002c:0566: eq?
002c:0567: bnt 13  [057c]
002c:0569: pushi 00aa
002c:056c: pushi 05
002c:056e: pushi 06
002c:0570: push0
002c:0571: pushi 08
002c:0573: push0
002c:0574: pushSelf
002c:0575: lag 5b
002c:0577: send 0e
002c:0579: jmp 00d9  [0655]
002c:057c: dup
002c:057d: ldi 04
002c:057f: eq?
002c:0580: bnt 12  [0594]
002c:0582: pushi 28
002c:0584: push1
002c:0585: pushi 0bb7
002c:0588: pushi 27
002c:058a: push1
002c:058b: pushSelf
002c:058c: lofsa 054e
002c:058f: send 0c
002c:0591: jmp 00c1  [0655]
002c:0594: dup
002c:0595: ldi 05
002c:0597: eq?
002c:0598: bnt 13  [05ad]
002c:059a: pushi 00aa
002c:059d: pushi 05
002c:059f: pushi 06
002c:05a1: push0
002c:05a2: pushi 09
002c:05a4: push0
002c:05a5: pushSelf
002c:05a6: lag 5b
002c:05a8: send 0e
002c:05aa: jmp 00a8  [0655]
002c:05ad: dup
002c:05ae: ldi 06
002c:05b0: eq?
002c:05b1: bnt 13  [05c6]
002c:05b3: pushi 00aa
002c:05b6: pushi 05
002c:05b8: pushi 06
002c:05ba: push0
002c:05bb: pushi 0a
002c:05bd: push0
002c:05be: pushSelf
002c:05bf: lag 5b
002c:05c1: send 0e
002c:05c3: jmp 008f  [0655]
002c:05c6: dup
002c:05c7: ldi 07
002c:05c9: eq?
002c:05ca: bnt 14  [05e0]
002c:05cc: pushi 00e1
002c:05cf: push0
002c:05d0: pushi 00a1
002c:05d3: push2
002c:05d4: class 1c
002c:05d6: push
002c:05d7: pushSelf
002c:05d8: lofsa 0336
002c:05db: send 0c
002c:05dd: jmp 0075  [0655]
002c:05e0: dup
002c:05e1: ldi 08
002c:05e3: eq?
002c:05e4: bnt 19  [05ff]
002c:05e6: pushi 03
002c:05e8: push1
002c:05e9: push0
002c:05ea: pushi 04
002c:05ec: push1
002c:05ed: pushi 0f
002c:05ef: pushi 00a1
002c:05f2: push2
002c:05f3: class 1d
002c:05f5: push
002c:05f6: pushSelf
002c:05f7: lofsa 0336
002c:05fa: send 14
002c:05fc: jmp 0056  [0655]
002c:05ff: dup
002c:0600: ldi 09
002c:0602: eq?
002c:0603: bnt 0e  [0613]
002c:0605: pushi 66
002c:0607: push0
002c:0608: lofsa 0336
002c:060b: send 04
002c:060d: ldi 02
002c:060f: aTop 1c
002c:0611: jmp 42  [0655]
002c:0613: dup
002c:0614: ldi 0a
002c:0616: eq?
002c:0617: bnt 12  [062b]
002c:0619: pushi 00aa
002c:061c: pushi 05
002c:061e: pushi 06
002c:0620: push0
002c:0621: pushi 0b
002c:0623: push0
002c:0624: pushSelf
002c:0625: lag 5b
002c:0627: send 0e
002c:0629: jmp 2a  [0655]
002c:062b: dup
002c:062c: ldi 0b
002c:062e: eq?
002c:062f: bnt 0e  [063f]
002c:0631: pushi 018c
002c:0634: push0
002c:0635: lag 01
002c:0637: send 04
002c:0639: ldi 01
002c:063b: aTop 1a
002c:063d: jmp 16  [0655]
002c:063f: dup
002c:0640: ldi 0c
002c:0642: eq?
002c:0643: bnt 10  [0655]
002c:0645: pushi 6e
002c:0647: push0
002c:0648: pushi 66
002c:064a: push0
002c:064b: lofsa 00c6
002c:064e: send 08
002c:0650: pushi 6f
002c:0652: push0
002c:0653: self 04
002c:0655: toss
002c:0656: ret
Anyone here feels up to it? (lskovlund, I'm looking at you...  )

[eisnerguy1]

Ah, was just about to post something similar here.  Great minds and all   If it helps at all, here's the site I put together with my findings so far:
https://dl.dropboxusercontent.com/u/17689746/Freddy_Pharkas/index.html

Short version is that thanks to various tools, I know what message the game displays when the easter egg happens, what sound is used (probably); what script, view, palette, position, scale & etc. are used but not how to actually get the easter egg to show up in the game normally

[troflip]

You could try decompiling the DOS version of Pharkas, and then pasting the disassembly you listed into script 270 in the right places (there will need to be some fixing up of syntax, since ScummVM asm output is different than Companion asm), then compile 270, and then re-decompile script 270 and see what you get.

Note, there are some problems with decompiling Freddy Pharkas script 270... to get around it, I changed bubbleSound to be of type Sound instead of FPSound. Not sure exactly what's going on, but that seemed to let it compile.

[Collector]

The pond is about three screens to the right, just past the school. It is the eastern most screen at that "latitude."

[lskovlun]

Good work on the extraction stuff. Omer, it looks like the top routine is mislabeled? You call it rm270::doit, but it looks very much like a changeState method to me (and the offsets are the same - cut/paste error?). So I'm not sure I can do it with this; since there appears to be objects with names like macThing, macSound and so on, finding the references to them would be the first step, and seeing how macThing triggers, if that is indeed the script responsible for the egg. 

[OmerMor]

Here are all the methods from script# 270 I could disassemble: http://pastebin.com/ssL1WJzF

I'm still having hard time understanding it 

[lskovlun]

I found the original files... it looks like clicking on the mine (look?) should activate the macThing script. Could it be that simple? (the position given in the files is x 300 y 20)

EDIT: oh, and the macSound object refers to sound number 2953, not 2541.

[eisnerguy1]

I found the original files... it looks like clicking on the mine (look?) should activate the macThing script. Could it be that simple? (the position given in the files is x 300 y 20)

EDIT: oh, and the macSound object refers to sound number 2953, not 2541.

I've tried that.  By looking at the Mine, a message pops up.  I've attached 2 screenshots.  This first is of my playing it in SheepShaver (Freddy_Pharkas_Mac_Message.png) & the 2nd (while playing it in ScummVM) shows exactly where to look at to see the message (Freddy_Pharkas_Mac_Message_scummvm50x.png).

In my research, macView is probably the easter egg itself in action.   macThing might be the message displayed in the screenshots attached. 

By using the ScummVM debugger console, I found the animation list for the swamp area of the game.  Something listed was "macView"


Oh & regarding "macSound", I thought referred to the Mac startup sound.  But, I used rezcycle on the "Data1" file and I checked the ?snd? folder (from the output of using rezycle on the "Data1" file) and the only thing that stood out was ?02541.aiff? which sounds like the old ?Droplet? alert sound from the System 7 days.  Here's the (what I think is macSound) and the Droplet sound:

macSound (?)
Droplet

I covered a bunch of what I uncovered so far on this site I set up (far too much stuff to post here).

[lskovlun]

macView is probably the easter egg itself in action.   macThing might be the message displayed in the screenshots attached. 

No macThing is a "script" (yes, there are several things that Sierra  called scripts, go figure). It contains the code that performs the easter egg - it does reference macView, and it is definitely activated from the mine. Did you try the talk icon on the mine, then?

[eisnerguy1]

macView is probably the easter egg itself in action.   macThing might be the message displayed in the screenshots attached. 

No macThing is a "script" (yes, there are several things that Sierra  called scripts, go figure). It contains the code that performs the easter egg - it does reference macView, and it is definitely activated from the mine. Did you try the talk icon on the mine, then?

I'm officially the biggest idiot in the world   If you use the "Talk" icon in the same spot that generates the "mac programmers" message, the easter egg happens   I didn't think about using the Talk icon in that same exact spot until I read your reply Here's the video I uploaded to YouTube showing the whole thing.  Thanks again for the help/inspiration!

[lskovlun]

"I'm the golden ball"? wtf?

There's a message in 270.msg right after the others that says "oh, sorry... I see you already have one" that would fit nicely at the end of that sequence. Looks like it got cut off?

[eisnerguy1]

"I'm the golden ball"? wtf?

There's a message in 270.msg right after the others that says "oh, sorry... I see you already have one" that would fit nicely at the end of that sequence. Looks like it got cut off?

I'm not sure.  The game kinda freezes in SheepShaver at the end of that video (the "wait" icon sticks around and you can't do anything in the game after that point) and the easter egg doesn't work properly in ScummVM (the golden ball audio keeps looping).

[OmerMor]

Great job Lars!
I spent hours on the disassembly and just started to understand what's going on.
I also noticed the bug in scunmvm regarding the audio loop.
I should probably file a bug.

[eisnerguy1]

Great job Lars!
I spent hours on the disassembly and just started to understand what's going on.
I also noticed the bug in scunmvm regarding the audio loop.
I should probably file a bug.

Already did:
https://sourceforge.net/p/scummvm/bugs/7065/

Feel free to add any more info in a reply if you want.

[eisnerguy1]

"I'm the golden ball"? wtf?

There's a message in 270.msg right after the others that says "oh, sorry... I see you already have one" that would fit nicely at the end of that sequence. Looks like it got cut off?

Sorry for bumping such a long-dead topic but, I finally figured out why the easter egg froze where it did.  Even though a patch utility was released for a few Mac games to fix various timing issues, it apparently does nothing for Freddy Pharkas.  I happened to search for some stuff on "comp.sys.mac.games" and found this post from 3/28/94:

"I have a MacIIci that was stalling whenever I tried to take the key out of
the church door.  I called Sierra Online Technical Support and they had me
set the date back to 1993 on the system clock and I have not had any
problem since.  Actually, the game has not crashed since I set the clock
back."

By setting the system clock back to 1993, not only does the Church Key not freeze/crash the game, the easter egg now plays in it's entirety: