Did not had a look at the setup yet (seems to be compressed/protected), but...
The ProRally.exe contains the well-known 5/2 test that often false-detects a Cyrix. The game later uses privileged instructions (out/in) to setup the CPU. The code is guarded by
Code: Select all
GetVersionExA(&VersionInformation);
if (VersionInformation.dwPlatformId == VER_PLATFORM_WIN32_NT)
...but as soon as you use Win9x compatibility shims the condition no longer avoids the privileged instructions if the 5/2 test "succeeds".
The test looks like this:
Code: Select all
.text:004BE0B0 55 push ebp
.text:004BE0B1 8B EC mov ebp, esp
.text:004BE0B3 51 push ecx
.text:004BE0B4 53 push ebx
.text:004BE0B5 66 33 C0 xor ax, ax
.text:004BE0B8 9E sahf
.text:004BE0B9 66 B8 05 00 mov ax, 5
.text:004BE0BD 66 BB 02 00 mov bx, 2
.text:004BE0C1 F6 F3 div bl
.text:004BE0C3 9F lahf
.text:004BE0C4 80 FC 02 cmp ah, 2
.text:004BE0C7 75 07 jnz short @@return_false
.text:004BE0C9 B8 01 00 00 00 mov eax, 1
.text:004BE0CE EB 05 jmp short @@return
.text:004BE0D0 @@return_false:
.text:004BE0D0 B8 00 00 00 00 mov eax, 0
.text:004BE0D5 @@return:
.text:004BE0D5 89 45 FC mov [ebp+var_4], eax
.text:004BE0D8 8B 45 FC mov eax, [ebp+var_4]
.text:004BE0DB 5B pop ebx
.text:004BE0DC 8B E5 mov esp, ebp
.text:004BE0DE 5D pop ebp
.text:004BE0DF C3 retn
To disable it find and nop-out (all 90) the following byte sequence:
Code: Select all
9E 66 B8 05 00 66 BB 02 00 F6 F3 9F
Note: The game is full of GetVersionExA/VER_PLATFORM_WIN32_NT conditions. You should avoid Win9x shims if possible.