Content for everyone

• Overview over the releases and variants of the game
• Frequently Asked Questions
• Cheats
• Patches
• Compatibility issues
  • Test results
  • Installing on a PCem Virtual Machine
  • Installing on a DOSBox Virtual Machine
• Extracted content:
  • All graphics
  • Soundtrack
  • Mouse cursors
• Playthrough -- coming soon
• Hidden/Unused stuff in the game:
  • Hidden configuration
  • Unused graphics
  • Unused sounds
  • Unused videos
• Fan art
• Reviews at magazines

Technical stuff

• PIPAVI.LST file
• GAME.SAV file
• How to disassemble
• Analysis of the ART files
  • Artfile variants
  • Packer/Unpacker written in C
  • All original ART files
  • Statistics
• Statistic of the used codecs in the game
• Analysis of the IPMA codec
• Analysis of ANIMDLL.DLL
• Technology overview

Links

• Walkthrough by MrLipid
• Panic in the Park at mobygames.com
• At The Cutting Room Floor -- coming soon
• Article at IMDb
• Panic in the Park at world-of-fmv.de (in German)
• Panic in the Park at fmvworld.com

YouTube Videos

• Walkthrough by 123Pazu
• (Partial) Let's Play by Pantsless Shorts
• Let's Play by RetrogradeTom (Part 2)
• (Partial) L.P. by HoFPG Hall of First Person Games

How to disassemble Imagination Pilots 16-bit games?

(Blown Away, Panic in the Park, Waldo Circus)

First, you need to strip the Watcom Extender which is in front of the actual 32 bit game code. Search for "MQ" and copy from there on. The file starting with "MQ" is the actual 32-bit executable in the Pharlap "REX" format.

This REX file begins with some relocation stuff, and then comes the REAL code.

Copy this code into a BIN file. You can now disassemble this BIN file, and read it using IDA.

Here are some offsets:

Blown Away Retail (EXE):
REX starts at D990
Code starts at D990 + B820 = 191B0
See my IDA 5 Pro database with some annotations (as ASM file)

Blown Away Preview Edition (EXE):
REX starts at D9B8
Code starts at D9B8 + CB60 = 1A518

Blown Away NimGame Demo (EXE):
REX starts at D9B8
Code starts at D9B8 + C1B0 = 19B68

Panic in the Park Retail (EXE):
REX starts at C1D8
Code starts at C1D8 + 11C90 = 1DE68

Waldo in the Circus, English (EXE):
REX starts at AD98
Code starts at AD98 + 2B590 = 36328

Waldo in the Circus, French (EXE):
REX starts at E000
Code starts at E000 + 2B0C0 = 390C0

I add a few thousand additional null bytes at the end, so that Xref's can be handled with IDA

Using OpenWatcom's wdump, you can dump the header of the REX file. You will see the initial EIP (for Blown Away Retail : 20238h) which you can use to start the auto-analysis of IDA.

It seems like the original game was built with Watcom 10.0a. In my Blown Away patch I did a re-bind (wbind.exe) to bind the REX code to the PharLap extender, and it worked. The resulting file is a bit different, but that might be because of the resource section. Re-binding the REX code with Watcom 8.5, 10.5, 10.6, 11.x will just result in a bluescreen.

Attention in regards to patching: The fixed addresses may not be moved, because the extender changes the assembly on-the-fly, updating the addresses according to the relocation table. So, if the address reference is then somewhere else due to changed assembly code, the game will crash

Example; This patch is OK:

	xor eax,eax		--> nop
				--> nop
	mov ebx,0x1234567	--> mov ebx,0x1234567 (stays)

This patch is NOT OK and will crash the game:

	xor eax,eax		--> mov ebx,0x1234567 (did move!)
	mov ebx,0x1234567	--> xor eax,eax