Restoration of differing Heretic and Hexen EXE revisions

Things that are still useful but aren't launchers, engines, or editors go here.

Restoration of differing Heretic and Hexen EXE revisions

Postby NY00123 » Tue Apr 28, 2020 12:21 pm

Hi all,

Let me introduce you to the following collection of repositories:

Basically, most of this work involves reverse-engineering of code related to games. However, rather than REing a whole game, what I usually do is RE a different version of an already open-sourced game. The success rates vary greatly, due to the technicalities involved.

I got this idea after the open-source release of not just one, but multiple DOS versions of Softdisk's Keen Dreams title. In particular, I had a look at the revision matching shareware v1.13. Using what I assumed to be the exact process for making the EXE, I got precisely the original EXE from the 90s, byte-by-byte. This process includes usage of the right compiler version, as well as packing the EXE with LZEXE 0.91.

Back to the above-mentioned collection of repositories, a more successful example that you may find is the code for Wolfenstein 3D and Spear of Destiny. With minor exceptions for certain Spear of Destiny EXEs, this should cover EXEs that may be perfectly recreated, byte-by-byte.

Examples are the Apogee versions (shareware/registered versions 1.0, 1.1, 1.2 and 1.4(g) without disabling the cheats), as well as the Activision versions. With the assistance of earlier REing work done by Blzut3, I also added the DOS version of Super 3-D Noah's Ark, which can be perfectly recreated, minus the debugging information. I further have a separate tree for Blake Stone, similarly building upon Blzut3's work for REing Aliens of Gold (the open-source release covers just Planet Strike).

Now, my most recent addition is Hexen 1.0, with version 1.1 also being covered. You can find these under the "hexen" submodule.

In the case of Hexen, especially version 1.0, the EXE isn't exactly matching in layout, although there are great chances that it's otherwise identical in behaviors. Saved games compatibility might be an exception; I'm not sufficiently familiar with Hexen's saved game format to know for sure.

More notes to add:
- Like the original open-source release of Heretic and Hexen, this is not including the proprietary DMX sound library. I've added a GPL-compatible replacement, albeit it won't sound exactly the same, especially the music (excluding CD Audio). Some of you may recall Nuke.YKT's PCDoom port. As a part of his work on it, he created a DOS-compatible DMX wrapper which is backed by the Apogee Sound System. So, I've made a few changes to the wrapper and then uploaded it. You'll need to have the submodule subdirs of "audiolib", "apodmx" and "hexen" residing in the same directory.
- As usual with public repositories, there might be changes later, like using output directory names differing from "10" or "11". Just for one example of an explanation, I've recently learnt that there might actually be two original Hexen DOS EXEs identified as 1.1, with one of them possibly including the following A_SoAExplode bugfix for DK, which I've disabled for now: ... lines-1161
- What about other id Tech 1 games, like Doom or Heretic? Well, Doom is expected to be quite more difficult, since we don't have access to original DOS sources. Heretic should hopefully be closer to Hexen, in case I get to it; Although, while working on Hexen 1.0, I occasionally used Heretic code as a reference (even bringing a few functions from Heretic as-is). I might not have this privilege for older versions of Heretic. What I can say, though, is that an earlier inspection of Nuke.YKT and me shows that the Heretic sources appear to match version 1.3.
Last edited by NY00123 on Tue Nov 03, 2020 4:49 pm, edited 1 time in total.
Joined: 25 Apr 2020

Re: Restoration of Hexen 1.0 and other games' EXE revisions

Postby Blzut3 » Sat May 02, 2020 11:54 am

NY00123 wrote:I've recently learnt that there might actually be two original Hexen DOS EXEs identified as 1.1

Given the name of the macro, are you speculating that this second 1.1 exists or has it been found in the wild?
Pronounced: B-l-zut
Joined: 24 Nov 2004
Github ID: Blzut3
Operating System: Debian-like Linux (Debian, Ubuntu, Mint, etc) 64-bit
Graphics Processor: ATI/AMD with Vulkan Support

Re: Restoration of Hexen 1.0 and other games' EXE revisions

Postby NY00123 » Sun May 03, 2020 3:44 pm

Blzut3 wrote:Given the name of the macro, are you speculating that this second 1.1 exists or has it been found in the wild?

The usage of this macro was added near the beginning, and was technically the first usage of any such macro in the git log for Hexen. So, I just used AV_HR_OPENSOURCEREV, in a similar manner to the Duke3D tree having AV_DR_DN3DGPLSRC for the "source" dir of the GPLed release from 2003 (excluding changes which were probably done by Charlie Wiederhold before releasing the code).

I found an alternative 1.1 EXE, which differs from the one available from Steam, in this repository: ... la-engine/

A short while after my original post here, I verified that this other EXE is indeed matching the Hexen sources as originally released. In particular, these are the few differences that I could find:
- The A_SoAExplode bugfix being present in the EXE from the above repo (not fixed in the EXE from Steam).
- VERSION_ID is set to CBI in the earlier 1.1 EXE from Steam, and to BCP in the later one.
- The expanded __DATE__ string differing as expected.
Joined: 25 Apr 2020

Re: Restoration of Hexen 1.0 and other games' EXE revisions

Postby NY00123 » Mon Oct 26, 2020 2:51 pm

The Hexen repository has been updated.

- First of all, albeit this dates back to the end of last May, the repository should now cover two variations of version 1.0, as well as two variations of version 1.1.
- As previously stated, the two EXEs identified as 1.1 differ just by the A_SoAExplode -nomonsters bug fix and the VERSION_ID string.
- Regarding the two EXEs identified as 1.0, they differ just by making the call to S_StartSongName from P_SetupLevel conditional, depending on the value of i_CDMusic.
- Finally, a major addition to the repository is Shareware Demo v1.0.

Due to the lack of a preprocessor macro for the demo, I had to manually figure out which definitions are missing. At the least, there wasn't a lot of new code to add.
Examples of differences:
- Various sprite, state and map object definitions are omitted.
- A_ACTION.C:A_SoAExplode is not present in the demo.
- SB_BAR.C: The cheat codes differ, and so does their encryption.
- R_DATA.C:R_InitTextures: ST_Progress is called once per 8 textures in the demo, instead of once per 32 textures.
- H2_MAIN.C: It looks like the DoTimeBomb function was repurposed for the demo.
- P_SETUP.C: DEFAULT_SKY_NAME was changed from "SKY1" to "SKY2" for the demo.
- A_SmokePuffEntry and A_SmokePuffExit were (probably) moved to the end of P_ENEMY.C in the demo version. As a side-note, A_SmokePuffEntry itself isn't present in v1.1, and there's currently no use of it in the codebase at all.
- I_IBM_A.ASM:I_ReadJoystick_: pushad and popad were replaced with pusha and popa, respectively.
- HEX.LNK, HEX_DMO.LNK: i_cdmus.obj is the first obj file to be listed for the demo.
- P_ENEMY.C:A_Explode: For an actor of type MT_HAMMER_MISSILE, damage isn't explicitly set to 128 again in the demo. For MT_ZXMAS_TREE, distance is set to 40 in the demo, instead of 64.
- P_ENEMY.C:A_DemonAttack2: P_SpawnMissile is called with a hardcoded mobj type of MT_DEMONFX1 (MT_DEMON2FX1 isn't present in the demo).
- P_SPEC.C:P_ExecuteLineSpecial: If the input special value is 74 (Teleport_NewMap) and all conditions required for calling G_Completed in non-demo versions hold, then G_Completed may be called only if args[0] <= 4. In case args[0] > 4 and &players[consoleplayer] == mo->player, an "ACCESS DENIED -- DEMO" message is prepared to be shown.
Joined: 25 Apr 2020

Re: Restoration of Hexen 1.0 and other games' EXE revisions

Postby NY00123 » Tue Nov 03, 2020 4:46 pm

Hi all,

I'll first add a little reminder that what I did with Hexen can't be easily done with Doom; Reason being that we got original DOS sources for Hexen (which turned out to match a later "v1.1" variant), while for Doom, we got linuxdoom-1.10.

On the other hand, I've added a new repository for Heretic. It may currently be found in the same location as before (i.e., where apodmx and hexen are present).

As I wrote earlier, the open-source release of Heretic essentially matches version 1.3. What I did was recreating the code for version 1.2, which isn't very different from 1.3, and then also for shareware and registered v1.0. The latter two EXEs are again similar to each other. The most significant differences are between versions 1.0 and 1.2/1.3.

I also updated the apodmx repository, so you can now generate a library which is compatible with the Heretic sources as originally released. All I did was replacing the _dpmi_lockregion and _dpmi_unlockregion macros with equivalent functions.

Regarding Heretic, as of writing this, you can still find in P_PSPR.C, INFO.H and INFO.C recreated Phoenix functionality (including an mobj type) that I'm not sure what was its purpose. It's actually possible that it's unused in v1.0, thus explaining its later removal.

Another unused function in which ones may have interest, is the one which I called A_Flash for now. It's very similar in structure to A_Raise, and is the only one making use of weaponinfo_t's "flashstate" field. In practice, this field never differs from NULL in v1.0, so it's probably just another case of incomplete or removed functionality.

My setup of the scripts for the modified Heretic source tree may seem a little bit more convoluted. It basically turned out that the output of Watcom C, at least with version 9.5a and/or close enough, can be impacted by setting an environment variable which should otherwise not be related at all. Even without that, there's still the problem where the compiler inserts environment and/or source code dependent data between C string literals.

On the other hand, we're more lucky than in the case of Hexen v1.0 in one important manner: Assuming DMX is used, I could get the global variables to be ordered exactly as with the original EXEs. This means that their addresses matched the originals. Additionally, at least in my case, each generated binary wouldn't differ from the matching original one (minus the DOS/4GW loader) by more than 600 bytes.
Joined: 25 Apr 2020

Re: Restoration of differing Heretic and Hexen EXE revisions

Postby NY00123 » Sun May 09, 2021 2:09 pm

Hey there,

I've gotten another addition for the Hexen repository. To make this short, it should now cover code which is more-or-less fully equivalent in behaviors to the 4-level beta (Oct 2 1995).

There's probably too much to write about the code itself, so I'll simply mention the following examples of information:
- This revision has code for the removed fly creature (
- The 4-level demo from Oct 18 1995, previously named HEXDMO10 in my repository, was renamed HEXDM10B, while the earlier demo was named HEXDM10A.
- I considered renaming HEXDM10B back to HEXDMO10, while HEXDM10A would be renamed using (a subset of) the EXE's original modification date; Reason being, the latter is identified as a beta in-game, and I already did a similar thing with a Wolf3D proto. beforehand.
- However, both versions are referred to as demos in the README.TXT files from 1995. I also don't currently recall any mention of a version number, like 1.0. For now, I just keep using the names of HEXDM10A and HEXDM10B.
- I originally started to inspect the 4-level beta as a possibility after finishing with Heretic 1.0-1.2. I eventually returned to the beta more recently. What's clear is that it required more work to recreate the code than the previously covered versions of Hexen; Maybe even more than all previously covered versions of Heretic and Hexen, combined.
- In addition to the previously known issue of global variables not being fully ordered as in the original EXE, there are also a few functions that I couldn't get their compiler-generated layouts to fully match. Unless I missed anything, they should still match in behaviors. The functions in question are A_Quake, P_XYMovement and P_ZMovement. The latter's C code was actually not changed by me at all.
Joined: 25 Apr 2020

Re: Restoration of differing Heretic and Hexen EXE revisions

Postby Gez » Mon May 10, 2021 5:38 am

nitr8's wish, finally fullfilled!

Do you confirm Randi's findings?
Code: Select allExpand view
    // The version from the retail beta is not so great for general use:
    // 1. Pick one of the first fifty thinkers at random.
    // 2. Starting from that thinker, find one that is an actor, not itself,
    //    and within sight. Give up after 100 sequential thinkers.
    // It's effectively useless if there are more than 150 thinkers on a map.
Joined: 06 Jul 2007

Re: Restoration of differing Heretic and Hexen EXE revisions

Postby NY00123 » Tue May 11, 2021 2:52 pm

Gez wrote:nitr8's wish, finally fullfilled!

I guess that's the closest to it!

Do you confirm Randi's findings?

While I reversed the behaviors from the 4-level beta (rather than the retail store beta), randi's description looks quite close.

The fly actions themselves may currently be found here: ... #lines-615

The fly's states in the state table are here: ... lines-2874

The same file also has an mobjinfo struct, which may currently be found by looking for MT_FLY. As expected, its DoomEd number is 112.
Joined: 25 Apr 2020

Re: Restoration of differing Heretic and Hexen EXE revisions

Postby NY00123 » Thu May 20, 2021 3:42 pm

So, it's possible that anybody who tries to cover all versions from a single EXE might find it difficult to do so at this point.
That is, unless you go for what I did in Reflection Wolfenstein 3D, as it more-or-less covers separate builds of different game versions in a single exe.

As of this post, the following additions are now in:
- 3-level shareware beta of Heretic (Dec 20 1994).
- Retail store beta of Hexen (Sep 26 1995).

These will probably be the last additions related to Heretic and Hexen. As usual, there's no promise regarding any future endeavor.
To summarize, we ended with 5 distinct DOS builds of Heretic, and 7 of Hexen.

As I suspected, it still took significantly more time to work on the beta release of the 4-level Hexen demo (given preceding work on v1.0 and the demo re-release), compared to the work on the aforementioned two betas of Heretic and Hexen.

In certain technical manners, the two Hexen betas might be close, even if obviously not identical. The aforementioned removed fly code is the same, just for one example.

I did have issues with the generated layouts of the following functions in the Hexen betas again: A_Quake, P_XYMovement and P_ZMovement. As mentioned earlier, the latter's C code was actually not changed by me at all.

In the case of Heretic, I suddenly spotted a different layout for M_FindResponseFile in a recent build of 1.2. I did it see beforehand, also in Hexen, but I thought that it was not reproduced after I finished working on each of the differing Heretic versions, excluding the beta. At the least, the code size, including padding for alignment, remained the same, so the other functions did match in layouts and locations.
Joined: 25 Apr 2020

Return to Miscellaneous

Who is online

Users browsing this forum: No registered users and 0 guests