Analysis model: GPT-5 (Codex), reasoning level not exposed Last edited: 2026-08-30 # The Festering Pit of Vile Excretions BBS (3) by The Humble Guys - Technical Dissection `The Festering Pit of Vile Excretions BBS (3)` is a real April 1991 MS-DOS BBStro attributed to The Humble Guys. Its apparent red sports-car illustration is a static ANSI/CP437 page signed `ANSi Magius ACiD`. The 5,353-byte `TRYME.COM` contains a conventional MZ program, 53 authored output fragments and a tiny ANSI-stream driver. There is no realtime demo effect behind the screen. The program makes 107 unrolled string calls, sends 3,745 bytes through DOS standard output, and exits immediately. An ANSI console driver interprets 417 CSI commands to place and colour the car, board information and signature. The earlier research queue associated this file with *Predator 2*. The examined archive contains only `TRYME.COM`; it has no game, release note, trainer or companion metadata. This pass therefore preserves it as a genuine standalone BBStro and does not claim a proven parent software release. ## Sources - [Demozoo production page](https://demozoo.org/productions/165436/) - [Scene.org archive](https://archive.scene.org/pub/demos/compilations/lost_found_and_more/bbs/the_festering_pit_bbs3.zip) - [Pouet production page](https://www.pouet.net/prod.php?which=68546) Demozoo identifies the production as an April 1991 MS-DOS BBStro by The Humble Guys and an advert for The Festering Pit. It also notes that the originating ANSI artwork is catalogued as `The Festering Pit w/F40`. Pouet independently lists the same group, platform, production type and 1991 year. The `Magius` and `ACiD` names used here come from the executable's visible art signature, not an otherwise empty catalogue credit section. ## Examined Artifact The archive contains one file: ```text 629f5d507c8eab6ed0cf19190613a9434508642988e5218e76bc5f71260a41b8 the_festering_pit_bbs3.zip 0295ca82aa46b5586cfa50feafb9b4da56e45f96b2b076f78caf45ebd76c9e8f TRYME.COM 5,353 bytes ``` The ZIP member timestamp is 22 November 2016 and matches the production's modern catalogue arrival, not its historical release. April 1991 comes from Demozoo. The `.COM` suffix is misleading. `TRYME.COM` begins with `MZ`, has a 512-byte header and is loaded as an EXE. No packer signature or depacking stub is present. ## Complete Silent DOSBox-X Run The exact executable was launched directly under DOSBox-X 2026.01.02 on 30 August 2026 with `machine=svga_s3` and 3,000 fixed cycles. SDL used dummy video and audio host drivers; the DOSBox mixer had `nosound=true`, and Sound Blaster, MIDI and PC-speaker output were disabled. The program has no sound code. `DX-CAPTURE /v TRYME.COM` observed the complete route. DOSBox-X's internal ANSI console support interpreted the emitted control stream, the full car page appeared, and the process returned normally before scheduled input was needed. The resulting diagnostic is 3.025 seconds long because it consists almost entirely of the capture command's post-exit hold. There is no animation or interactive gate to traverse. The private final frame is an uncropped 720x400 capture, also checked as a nearest-neighbour 720x540 square-pixel presentation. It is not published because one central text row contains a complete historical telephone number. The page's overall visual—a red front-view sports car around a black information panel, with the ANSI/ACiD signature at lower left—is described here without reproducing that contact line. ## Exact MZ Layout The MZ header describes the physical file exactly: ```text file / declared size 5,353 bytes header 512 bytes load image 4,841 bytes relocations 1 entry CS:IP 0000:0000 entry file offset 0200h stack SS:SP 012F:0400 minimum allocation 65 paragraphs checksum word 7193h ``` The 16-bit sum across the complete padded file is `FFFFh`, so the nonzero MZ checksum is internally consistent. The sole relocation points to load offset `03C8h`, the segment immediate used to establish the data segment. The load image divides cleanly: ```text 0000h..03D7h 984 bytes entry, output dispatcher and helpers 03D8h..1247h 3,696 bytes NUL-terminated ANSI/CP437 fragment strings 1248h..12E8h 161 bytes output mode, parser state, DTA and zeroed runtime tail ``` The corresponding region hashes are: ```text 2fef1868ab1824ebb65b679b6478eae933f2854ba39a68b9f95f0800a3394284 code 8416aa4713efe434479db1d35facea83420692ed3b836474527b83303c675cdb ANSI strings 9cc08f0aeee7e98812a2e9663554bea4c468fcf9c46bcb9877532b27a2a8b203 runtime tail a7075e8d59bf7328b1af660300dfef6cedc6b7c15712214f450f5154b3ac2635 load image ``` ## Startup And Relocated Data Segment The entry begins with two setup calls before the unrolled string list: ```asm 0000 call 03B4h ; memory/data/DTA setup 0003 call 0379h ; select DOS/ANSI output mode 2 0006 mov si,0008h 0009 call 028Eh ; emit ESC [ 2 J 000C mov si,000Dh 000F call 028Eh ; first long artwork fragment 0012 mov si,0056h 0015 call 028Eh ; shared LF,CR string ``` The startup helper shrinks the process allocation and loads the relocated data segment. Before relocation, the immediate is `003Dh`; DOS adds the program load segment through the one MZ fixup at offset `03C8h`: ```asm 03B4 mov ax,ds ; PSP segment 03B6 mov es,ax 03B8 mov bx,ss 03BA sub bx,ax 03BC add bx,0060h 03BF mov ah,4Ah 03C1 int 21h ; resize process block 03C3 mov es,[002Ch] ; environment segment from PSP 03C7 mov ax,003Dh ; relocated to load segment + 003Dh 03CA mov ds,ax 03CC mov [0E8Bh],es 03D0 mov ah,1Ah 03D2 mov dx,0E99h 03D5 int 21h ; install private DTA ``` Runtime `DS:0000` therefore corresponds to load offset `03D0h`, and the first real string at load offset `03D8h` is addressed as `DS:0008h`. The overlap is intentional: the last eight code bytes sit below the first used data offset. ## The Main Program Is An Unrolled Fragment List From `0006h` through `0287h`, the main routine contains 107 identical `mov si,offset / call 028Eh` pairs. Every call targets the same NUL-terminated string printer. There are 55 unique string offsets: - one initial clear-screen string; - 53 artwork/cursor fragments; - one shared two-byte `LF,CR` string at `DS:0056h`, called 53 times. The 55 unique strings contain 3,641 bytes. Reusing the newline string after every fragment raises the actual output to exactly 3,745 bytes. There is no loop counter, file read, decompressor or runtime page buffer; the compiler or generator simply emitted the entire call schedule inline. The first artwork fragment even begins with a second clear and then positions the cursor before drawing the upper car edge: ```text ESC [ 40 m black background ESC [ 2 J erase display ESC [ 24 C move forward 24 columns ESC [ 0;1;31 m reset, bright red foreground 33 * CP437 DCh upper half-block run ESC [ 2;1 H cursor to row 2, column 1 ESC [ 19 C move forward 19 columns 2 * CP437 DCh ESC [ s save cursor ``` Later fragments use `ESC[s` and `ESC[u` to save and restore a construction position, absolute `H` moves for major rows, relative `C` and `A` moves for horizontal/vertical overlays, and SGR `m` commands for colour and intensity. ## One-Byte DOS Output Path Call `0379h` stores mode 2 at `[0E78h]`. The common printer at `028Eh` sees that mode and chooses DOS standard output rather than its BIOS fallback: ```asm 028E cmp byte [0E78h],1 0293 je 02C9h ; mode 1: BIOS/custom CSI path 0295 mov dl,[si] 0297 or dl,dl 0299 je 02C8h ; NUL terminates this fragment 029B inc si 029C cmp dl,5Ch ; optional backslash escape syntax 029F jne 02C2h ... ; \# -> ESC, \\ddd -> byte value 02C2 mov ah,02h 02C4 int 21h ; one byte to standard output 02C6 jmp 0295h 02C8 ret ``` The examined strings already contain literal escape and CP437 bytes, so the optional backslash conversions are never used. The path executes DOS function 2 exactly 3,745 times. An installed ANSI console layer consumes the CSI sequences; ordinary CP437 bytes become visible glyphs. The complete emitted stream hashes to: ```text 6a75b2fdd1eead551c152dbba5e70ef0a5903a5c3cc0b300a40a3e420b1688b5 3,745-byte output stream ``` ## ANSI Command Ledger The stream contains 417 `ESC [` control sequences and 53 `LF,CR` pairs: | Final byte | Count | Role in this page | |---|---:|---| | `m` | 271 | Select foreground/background colours, brightness and reset state. | | `C` | 59 | Move the cursor right by a counted number of columns. | | `s` | 27 | Save a cursor position before a split fragment. | | `u` | 27 | Restore the saved position for the continuation. | | `H` | 18 | Place the cursor at an absolute row/column. | | `A` | 13 | Move up for a later overlay on a previously visited row. | | `J` | 2 | Clear the display at startup. | The drawing is consequently not a simple top-to-bottom text dump. The first half builds the roof and information panel with paired save/restore fragments; the later fragments revisit rows to close body panels, add wheel and bumper shapes, and place the lower-left signature. CP437 bytes `DBh`, `DCh`, `DDh`, `DEh` and `DFh` supply full, upper-half, left-half, right-half and lower-half blocks; box-drawing bytes supply small panel borders. The final frame is visually dense, but the mechanism is terminal composition: ANSI cursor state plus coloured text cells. No code ever addresses `B800h`, `B000h`, `A000h`, VGA registers or a software framebuffer. ## Unused BIOS Fallback Mode 1 at `02C9h` is present but not selected by this entry route. It emits ordinary bytes with BIOS `INT 10h/AH=0Eh` and recognizes only enough CSI syntax to support clear/mode reset (`J`) and absolute cursor positioning (`H`). Its decimal parser at `038Eh` accumulates numbers as `value = value*10 + digit`. That fallback is useful provenance for the executable generator, but it is not the observed renderer. The default mode-2 path deliberately delegates the full SGR, save/restore and relative-cursor command set to the DOS ANSI console. ## Immediate Exit And Persistent Screen After the last `ESC[0m` fragment and final `LF,CR`, main does not wait for a key: ```asm 027C mov si,0E73h 027F call 028Eh ; ESC [ 0 m 0282 mov si,0056h 0285 call 028Eh ; LF,CR 0288 mov ax,4C00h 028B int 21h ; normal DOS return ``` It also does not clear or restore the page. DOS inherits the completed text screen, which is why the final car remains visible throughout the capture command's post-exit hold. The cursor at the lower left belongs to the returned console state, not an intro key prompt. ## Runtime-To-Code Concordance | Runtime evidence | Recovered mechanism | Conclusion | |---|---|---| | A complete red car and central board panel appear in colour text mode | 53 stored fragments contain ANSI cursor/SGR commands plus CP437 block characters | The image is terminal artwork, not a bitmap or realtime renderer. | | Distant portions of the car settle into one static page almost instantly | Main makes 107 unrolled printer calls; 417 CSI commands revisit rows and columns | The apparent assembly is ANSI cursor composition completed faster than capture cadence, not authored animation. | | No key was needed and the capture is almost entirely post-exit hold | Main ends directly with `AX=4C00h` / `INT 21h` | There is no hidden interaction, timeout or second screen. | | The screen remains after return to DOS | No cleanup follows the last reset/newline string | Persistence is inherited console memory, not a resident process. | | The screen is silent | The only interrupts used are DOS memory/DTA/output/exit and BIOS calls in the unused fallback | No music or sound-effect path exists. | | The archive has only `TRYME.COM` | Neither embedded text nor package members name Predator 2 | The BBStro is genuine, but the earlier claimed software bundle is not proven by this artifact. | This is a technically modest production, but not a fabricated one. Its value is the unusually transparent preservation boundary: one intact MZ, one signed ANSI work, one exact 3,745-byte console stream and a normal immediate return.